Apple says it is changing its macOS privacy settings to stop third-party app developers from misusing them to access message histories.
Friday's announcement comes two weeks after tech columnist Jason Aten said that Meta’s new general-purpose AI agent Muse sent him an unsolicited notification referencing a thread between him and a co-worker over Apple Messages. Aten said he never granted Muse permissions to read his messages and had assumed they were off-limits. Social media last week blew up with masses of people who agreed and said the incident showed that AI assistants given access to calendars, emails, messages, shopping accounts, and other resources are akin to a skill saw or other power tool. While potentially useful, they can do real damage if not used carefully.
He said/she said
Meta CTO David Singleton joined the fray with a rebuttal that appeared solid. For Muse to access Apple Messages, a user must manually give it two privileges. One is full-disk access, a macOS system-level permission. The other is to enable a Messages connector setting in Muse.
If you've updated your iPhone to iOS 27, you might have already put Siri AI to the test or tried out some of Apple's AI-powered photo editing features. But you may have also noticed something else: Your iPhone's battery isn't lasting as long between charges. While I can't say this is a universal experience (I'm don't believe my iPhone is dying faster on iOS 27 than it did on iOS 26), some users are adamant the update has had a detrimental effect on their battery life. And while there are many possible factors here, some think they have found the culprit: a feature called Connectivity Assist.
What is Connectivity Assist?
Connectivity Assist's mission is noble. The feature is designed to tap into cellular data any time your wifi connection grows too weak. In theory, it should be particularly useful when you're leaving an area with wifi; rather than deal with the slow loading times a weak wifi connection forces you to endure before it disconnects outright, your cellular network would kick in to maintain your speed. (Once you've left wifi range, you'd be back on cellular completely either way, of course.)
Technically, this feature isn't new. Before iOS 27, Apple called it "Wi-Fi Assist," but it worked a bit differently. In iOS 26, Wi-Fi Assist simply switches over to cellular when your wifi signal is too weak. With iOS 27's Connectivity Assist, it seems your iPhone can tap into both networks at the same time. If so, that may play some role in why this rejiggered feature seems to be dragging down people's batteries more than it used to.
There's another new addition with Connectivity Assist that could also be part of the problem: Unlike Wi-Fi Assist, Connectivity Assist sends DNS requests over cellular data, which can bypass the rules that ad blockers put in place to stop pop-ups from making their way into your iPhone. As such, even Apple recommends that you disable Connectivity Assist if you use an ad blocker. So, if your iPhone is constantly sending out DNS requests while on cellular data, bypassing your active ad blockers, that could be putting extra strain on your battery, too.
How to disable Connectivity Assist in iOS 27
Reddit user ZoteTheMitey shared their experience on the r/iPhone subreddit, claiming that their iPhone 15 Pro Max, with 89% battery health, was only lasting for three to four hours following the switch to iOS 27. Once they disabled Connectivity Assistant, they claim their battery usage time jumped to seven hours. Some users in the thread shared similar experiences, and one even claimed disabling the feature fixed an issue with their device overheating.
If you want to try the potential solution yourself, here are two ways to disable Connectivity Assist: First, you can disable it on a per-network basis. To do so, head to Settings > Wi-Fi, then tap the (i) next to your network name. Here, scroll down, and make sure the toggle next to "Use Connectivity Assist" is turned off. That was, you can make sure your battery isn't experiencing faster drain when you're away from a charger—say, at a cafe you frequent.
If you'd rather disable the feature globally for your iPhone, head back to the Wi-Fi settings page and ensure the toggle next to "Connectivity Assist" is set to off. Note: if this feature was previously enabled, you'll be able to see the amount of cellular data the feature has used to date, which will give you an idea of how often it has been active on your device. More data could mean more potential battery drain.
When Apple releases a new watch, it’s not always worth upgrading. Last year’s Series 11 only had a few barely noticeable features to recommend it over the 10, and we said it’s probably one to skip if you’re happy with your current watch. But the Series 12 is different, and this one is worth the upgrade no matter which Apple Watch you’re coming from.
One of the biggest reasons to upgrade is that the Series 12's new processor (called, confusingly, the S11 chip) can support some features older Apple Watches can't. That's why only the new models are getting step counts, for example; Apple chose to implement those in a way that only the new hardware can calculate. Whenever there's a break in software compatibility, it makes sense to get the newer model. I'd expect more features are coming in future years that will be back-compatible with the 12 but not earlier models.
The heart rate sensor is a big upgrade
Apple upgraded the hardware on the back of the watch that optically reads your heartbeats. (This new sensor is in both the Series 12 and the Ultra 4.) I’ve tested its accuracy, and found it’s substantially better than the sensors in previous Apple Watches like the Series 10 and 11. If you train by heart rate during workous, or if you use heart rate data after the fact to evaluate and plan your training, the upgrade is worth it.
Apple claims it provides the most accurate heart rate of any wearable. I tested that claim and can partially agree: It’s as good as Garmin’s top-of-the-line sensor. I wouldn’t say it’s better than Garmin’s, but the two are tied in my book for the best wrist-worn sensor. (Chest straps are better than any wrist-based system, of course.)
Steps on the watch face are a nice plus
I wouldn’t buy a new Apple Watch just for the step count, but it’s a nice upgrade and one I deeply appreciate. I can add a step count complication to my watch face (I have it in a corner of the Modular face right now) and I have step count pinned to my Smart Stack.
If you don’t upgrade, you use use a third-party step counter to provide a complication for your watch face. But it’s nice that Apple finally has this feature built in. Apple says its step counts are the most accurate; I’ll be testing that claim soon.
Readiness and recovery HRV are another nice extra
The Apple Watch was always capable of measuring HRV, but until the Series 12 (and Ultra 4), it didn’t use the RMSSD version, which is most useful for gauging how stressed or recovered you are. (Instead, it used the SDNN version that can provide some information about cardiac health; the newer Apple Watches can do both.)
This means you can now get an overnight HRV reading that matches the kind of data you can get from the Oura ring or Whoop. I find HRV useful in monitoring how stressed or fatigued I am, so if you already wear an Apple Watch, it’s nice to be able to get that data from the watch instead of needing a second device. Apple has added a readiness score that uses HRV to tell you how “ready” you are for the day.
What I’m less excited about in the Series 12
Besides the features above, Apple has announced a few things that it’s using as selling points for the Series 12, but I wouldn’t put too much weight on these. Some are software features, like a small upgrade to Workout Buddy and a big upgrade to the Health app on the phone; you don’t need a new watch for these. Others are actually tied to the watch, but they wouldn’t be a reason to upgrade, at least for me personally. They include:
Siri AI
There’s a new AI-based version of Siri, and it’s available on the watch. It can do a few things better than the old Siri, like searching your messages and emails, but it seems to have gotten worse in some respects. I wrote about my experience trying Siri AI on the watch; I got plenty of delays and errors that negated any small benefit of the new algorithm. I suppose it will get better over time, but right now, it's not very good.
Rewind and recaps
Apple touted two features on the new watches that feel a little more creepy than useful to me: Live Rewind, which gives you a text transcription of whatever audio it heard in the last 15 seconds; and Siri Recaps, which summarize meetings. Despite Apple’s assurances about privacy, it’s still a feature that's always listening to you and to bystanders who didn’t consent to be rewound or recapped. This feature isn’t live yet on my watch, so I can’t comment on what it’s like to use—but I’m not exactly thrilled about the idea.
On paper, the iPhone 18 Pro and iPhone 18 Pro Max are Apple's best smartphones yet. They run the new A20 chip, feature cameras that use a revolutionary variable aperture, and, according to Apple, have the longest battery life of any iPhone ever. And yet, the iPhone 18 Pro's launch has been a rocky one, beset by glitches and hardware issues that range in severity. Some have been fixed by simple software updates, while others remain unresolved.
None of this is to encourage you to return your iPhone 18 Pro or discourage you from buying one if you have your sights set on Apple's newest Pro phones. However, it's important to note that this has hardly been a drama-free rollout. As of this article, these are the four major problems I've seen with the iPhone 18 Pro and iPhone 18 Pro Max.
iPhone 18 Pros were randomly rebooting
The first iPhone 18 Pro issue that I saw was random reboots. Users complained that, after a failed Face ID attempt, their iPhones would freeze up and, after a short period of time, reboot. Curiously, Apple's newest Apple Watches, the Series 12 and Ultra 4, had similar reboot issues. While annoying, this was clearly just a glitch with Apple's newest iPhones running iOS 27 and Apple Watches running watchOS 27. The company quickly released patches for all devices in iOS 27.0.1 and watchOS 27.0.1, each of which only mentioned this singular patch in the release notes.
iPhone 18 Pro Max might not be able to dial 911
While Apple says iOS 27.0.1 only patches this reboot glitch, AT&T says otherwise. The company sent alerts to iPhone 18 Pro Max users last week urging them to update to this latest version of iOS, warning that iPhone 18 Pro Max users might not be able to text, call, or connect to data at times, including when dialing 911. The full message reads: "Hi, it's AT&T. Action needed: An important Apple software update for your iPhone 18 Pro Max is available. Some phones may be unable to complete calls/text/data, including to 911. Update to iOS 27.0.1 immediately — Settings > General > Software Update. Please contact AT&T or Apple if you have questions."
As it happens, iPhone 18 Pro users are not included in this alert. As MacRumors speculates, it might have something to do with the iPhone 18 Pro Max's modem. This is the only new iPhone this year to ship with a Qualcomm modem rather than Apple's own C2 modem. As MacRumors notes, affected iPhone 18 Pro Max users can lose service, forcing their phones to drop into SOS mode.
What's more, this update may only be effective at preventing the issue, not solving it. In a statement to 9to5Mac, Apple said: "We have identified an issue affecting a small number of iPhone 18 Pro Max users on the AT&T network that may cause a device to lose service and be unable to make calls. We released iOS 27.0.1 earlier this week and strongly encourage all iPhone 18 Pro Max users to update now, and are also issuing a carrier settings update today. These updates together are meant to help prevent this issue from occurring.” If your iPhone 18 Pro Max has already lost the ability to connect to cellular, however, 9to5Mac says you will need to swap it out for an entirely new phone with either Apple or AT&T.
Some iPhone 18 Pros have a cracking or popping noise
Some iPhone 18 Pro and 18 Pro Max users are reporting strange "cracking" or "popping" noises coming from their new smartphones' speakers. This Redditor shared that the sound comes intermittently from the upper speaker, and sounds like someone pulling an aux cable out of a headphone jack. Users in the thread concurred: One user complained of a light buzzing when the volume is set to 100%, while another said their iPhone has a crackling sound when on calls with "mono speaker." According to one Redditor, updating to iOS 27.0.1 didn't fix the issue.
While the thread is full of users complaining of similar issues, not everyone has the same experience. Some Redditors say they haven't heard the sounds on their iPhone 18 Pros, including multiple Mashable reporters. Another user noted that they're experiencing the issue on their iPhone 16 Pro Max since they updated to iOS 27.
Some iPhone 18 Pros are already losing their color
As Mashable highlights, some iPhone 18 Pro and 18 Pro Max users are noticing that the finish on their devices is starting to wear away, particularly around the camera lens. It seems the majority of the complaints, if not all of them, are from users with burgundy and black iPhone 18 Pro and 18 Pro Max devices, and it's not clear how widespread the issue is. Some users have claimed that cleaning the affected area with a Q-tip is enough to fix the issue, while others say the finish itself has worn away.
Apple's Photos app is more than a simple camera roll that eats up all your iCloud storage space. Contrary to popular belief, you can customize the app to make it easier to find the pictures and videos you're looking for, while hidden features help you clean up your storage and keep your media collection organized. If you have an iPhone, these 10 hacks are a must.
Use Reorder to customize what’s shown in the Collections screen
Credit: Khamosh Pathak
The Collections tab in the Photos app arranges itself automatically, showing you suggested photos, memories, and highlight reels at the top. Unfortunately, the way Apple orders things is a bit of a mess. The thing is, Photos has plenty of useful categories and shortcuts for accessing media quickly, such as for screenshots, custom albums, and utilities like Hidden Folder. As such, you should reorder the Collections tab to make it work better for you. Tap the Menu button at the top of the Collections tab and choose Reorder. My advice is to bring the Utilities and MediaTypes collections to the top, as they serve as useful shortcuts.
Use "Captured By Me" to hide screenshots and saved photos
If you're like me, your camera roll is filled with too many screenshots, saved photos, memes, GIFs, and videos. They all have their place, but the clutter gets in the way when you want to see or show photos you’ve actually clicked with your iPhone’s camera. As it happens, iOS 27 adds a new feature called "Captured By Me" that only filters photos and videos you’ve shot yourself. If you go to the Collections tab, you’ll find a new Captured By Me section in Utilities. You can also activate this when browsing photos in Library using the Filter button.
Hide photos of an ex from showing up in Memories
Credit: Khamosh Pathak
Apple’s Photos suggestions are so good, I let the app handle the images that show up on my iPhone and Apple Watch's wallpaper, along with a widget on my iPhone's Home Screen. But suggestions are only as good as your curation. The last thing you want is to see a photo of your ex (or an ex-friend) when you’re trying to get through emails in the morning. If you don’t want to see a person too often, open their photo, tap the Menu button and choose Don’t Feature a Person. You have two choices here. You can either choose Feature This Person Less or Never Feature This Person. The latter option, of course, is best for exes, while the former works better for anyone you don't want to cut out entirely, but would like to see a little bit less of.
Hide the Hidden folder to truly protect your sensitive photos
Credit: Khamosh Pathak
The Photos app's Hidden folder is an excellent tool for locking away pictures and videos from your main library. The issue is, the folder might still be accessable by anyone who gets their hands on your iPhone. As such, make sure to lock the Hidden folder behind a Face ID lock to truly protect your sensitive pics. To do so, go to Settings > Apps > Photos > Albums and enable Face ID to automatically enable the hidden folder lock.
Make sure to completely delete photos from the Trash
Deleted photos aren’t actually deleted—at least, not right away. Apple actually stores deleted photos for 30 days, helpful when you accidentally delete a photo or have second-thoughts, but it’s a double-edged sword. Someone in the know could snoop through your deleted album and retrieve images you assumed were gone forever. These photos and videos are also taking up storage you likely assumed you got back by "deleting" them. As such, make sure to empty the Trash as well. Go to Photos > Utilities > Recently Deleted and tap the Delete All button.
Use the Identity Documents collection to quickly find photos of your IDs
While it’s not the most secure option, keeping some identification documents, passes, or tickets as photos can help in a pinch. It seems like Apple knows that this is a common use case. In iOS 27, if you go to the Collections tab, you’ll find a new Identity Documents section under the Utilities dropdown. When you open it, you’ll find an automatically curated grid of all the photos that contain IDs. If you like this feature, I highly recommend using the first hack in this list to reorder the Collections screen, putting the Identity Documents section right at the top.
Use this hidden feature to force Photos to sync immediately to iCloud
iCloud can be a huge help for managing your ever-growing Photos library. As long as you have available cloud storage, photos and videos are uploaded in the background automatically, and if you’re low on storage on your iPhone, "Optimize Storage" automatically offloads the files to the cloud.
Unfortunately, sometimes it doesn’t work when you really want to. Perhaps you want to add photos in a shared album, or you want to see photos on your Mac. But your iPhone is low on battery, or on a spotty connection, so the photos never seem to sync. Now, if you’re running iOS 27, you can use a hidden setting to force iCloud sync. Go to Settings > Photos > Sync Immediately and enable For Today.
Use Clean Up's "High-Quality" mode to remove objects from your photos
Credit: Khamosh Pathak
When it launched, Apple’s Clean Up tool left something to be desired. It would remove objects, but leave weird shadows or blobs behind. With the release of Apple’s new Siri AI, Clean Up gets a big upgrade—but only if you use Apple’s iCloud servers. (Apple says its service, Private Cloud Compute, secures your data.) As such, Clean Up is now a reliable option to quickly remove objects from your photos. Open an image, tap on Edit, choose the Tools option, and select the Clean Up tool. From the top, make sure to switch to the High-Quality option to use Apple’s servers. Highlight parts to remove, and tap Clean Up. If it’s a heavier edit, you might need to wait for a minute or two. In my experience, the result will be worth it.
Use "Paste Edits" to copy and paste edits from one photo to multiple photos
Credit: Khamosh Pathak
It can get tedious to apply the same edits across multiple photos. Luckily, you don't need to waste time fiddling with the same sliders on each image: Photos lets you copy all edits from one image and paste them to multiple photos. To do so, choose your edited photo or video, tap the Menu button, and choose Copy Edits. Then, review and disable any edits you don’t want, and choose Copy. Now, go back to your Library, tap Select, and choose all the photos or videos where you want to apply the same edit. Tap the Menu button and choose Paste Edits to add the same edit settings to all images.
Use Live Text to pull text from images
Credit: Apple
Apple’s Live Text feature turns any text digital. Snap a photo of a menu, and you can copy it. Scan a page, and you can paste it in Notes. But it’s not just limited to the camera or screenshots: It’s integrated directly into the Photos app as well, and arguably, it’s the easiest place to use this feature. When you are viewing an image with text in it, you will see the Live Text icon in the bottom right. Tap on it, and iOS will highlight the text in the image. You can tap and hold to take action on text, and you can easily copy things from here as well.
We may earn a commission from links on this page. Deal pricing and availability subject to change after time of publication.
Apple products are infamously expensive, but that doesn't mean those prices never come down. While Apple doesn't typically offer discounts of its own, retailers frequently cut prices MacBooks, AirPods, and iPads, and such is the case with Amazon's Prime Big Deal Days sale. Even though October Prime Day is officially over, these are the best Apple deals you can still take advantage of.
M5 MacBook Air (13-inch)
The MacBook Air has long been the best choice for most people. While many would likely benefit from the simpler, budget MacBook Neo, there are plenty of perks for those who upgrade to the M5 MacBook Air: a bigger, better display; the M5 chip, which is much more powerful than the Neo's A18 Pro chip; Touch ID by default; and MagSafe charging, to name a few. Right now, Amazon has the 13-inch MacBook Air at $1,099, $200 below its newly inflated list price of $1,299.
Apple's 15-inch MacBook Air is a good option for users who want more screen real estate without having to pay "Pro" prices. Following recent price hikes, Apple's 512GB model retails for $1,499, but ahead of October Prime Day, you can save $200 on the laptop when buying through Amazon. According to Keepa, this is the 15-inch MacBook Air's best price in at least the last three months. With this MacBook Air, you get a 15.3-inch display, Apple's M5 chip with a 10-core CPU and 10-core GPU, 512GB of storage, 16GB of RAM, and up to 18 hours of battery life (according to Apple).
Apple's "Pro" MacBook Pro line used to start at $1,999. No longer: Apple's MSRP for the M5 Pro MacBook Pro is now $2,499. Expensive, but for many, worth it, since you get a powerful Mac chip with Apple's most feature-filled MacBook design. If you've been eyeing this model, good news: Amazon is currently taking $160 off. For $2,339, you can get a 14.2-inch MacBook Pro with a mini-LED display, the M5 Pro chip with 15-core CPU and 16-core GPU, 24GB of RAM, and a 1TB SSD. If you're looking for even more power, Amazon has a number of M5 Pro configurations discounted, including the 18-core CPU/20-core GPU model with a 2TB SSD ($2,699, down from $3,199).
While the M5 chip in the MacBook Air is more than enough to handle most computing tasks, Apple's M5 Max is on a whole other level. For users who do intense graphics work or AI processing, there are few chips better than the one found in this 14-inch MacBook Pro. Of course, all that power comes at a cost: Apple's MSRP for this particular configuration is $4,099. But right now, Amazon has it discounted by $600. For $3,499, you get a 14.2-inch mini-LED display, the M5 Max chip with an 18-core CPU and 32-core GPU, 36GB of RAM, and a 2TB SSD.
Apple's Mac mini is a favorite among AI agent fans, as well as users who want the best possible value in a powerful Mac. You'll need to provide your own keyboard, mouse, and monitor, but Apple's latest Mac mini is currently 13% off during the last hours of Prime Day, $779.99 instead of $899. It comes with Apple's latest M6 chip, 16GB of RAM, and a 256GB SSD. You'll find a 14% discount if you upgrade to the 512GB SSD, and an 11% discount on the M6 Pro model with 24GB of RAM.
As much as I love my AirPods Max, I have a hard time recommending them because of the price—$549 is expensive for wireless headphones, and it's tough to ignore other excellent options that cost hundreds of dollars less than Apple's. However, they become easier to recommend when they're on sale. Right now, you can pick up Apple's AirPods Max 2 for $429—still expensive, but a bit more reasonable. These are Apple's latest AirPods Max, with "new" features like Live Translation and Adaptive Audio.
Apple's third-generation AirPods Pro are excellent, but they're also pricey. For $249, you get Apple's best earbuds, with Active Noise Cancellation, Adaptive Transparency, a built-in heart rate monitor, and interchangeable tips to fit the buds to your ears. While these earbuds are arguably worth their MSRP, they're especially worth it on sale: Right now, you can take $70 off the price of the AirPods Pro 3, as Amazon is currently selling them for $179. Apple also offers cheaper AirPods with similar features, so unless you need the Pros' exclusive perks, you can save even more with the new, full-featured AirPods 5 ($149 for the version with the wireless charging case).
If you're looking for a pair of AirPods at the lowest possible price, look at this deal from Best Buy. The retailer has the Apple AirPods 4 for just $79, down from their original list price of $129.99. These are one generation old at this point, and this model doesn't have Active Noise Cancellation, but for the price, this deal is an excellent way to get the AirPods experience.
Apple's basic iPad—sometimes called iPad (A16)—is the best iPad for most people. Most of us only need an 11-inch tablet with a chip capable of running iPadOS, with 12MP cameras on the front and back of the tablet. While there are iPads with bigger displays, including some with OLEDs, as well as more powerful chips and better cameras, this iPad will generally be more than enough. Right now, Amazon has the 128GB model discounted by 11%, bringing the price from $449 to $399. If you think you might need more storage, Amazon has smaller discounts on the 256GB and 512GB options, as well as on the 128GB and 256GB cellular models.
Apple's latest iPad mini doesn't have the 17% discount it did during October Prime Day, but you can still save 5% right now. This iPad mini comes with Apple's A17 Pro chip, an 8.3-inch display, 128GB of storage, and 12MP cameras on the front and back of the tablet. 128GB isn't much, though it can go a long way if you mostly keep your files in the cloud. If you think you need more storage, Amazon is taking 5% off the 256GB model.
Apple's 11-inch iPad Pro is powered by the same M5 chip as the MacBook Air—though it still runs iPadOS. Despite missing perks you get with a laptop, like a built-in keyboard, trackpad, and macOS support, this iPad Pro isn't too far off from the MacBook Air's price tag. Typically, this unit retails for $1,199, but Amazon has it listed at $100 off. Not the biggest discount, but you could apply those savings towards an Apple Pencil Pro—currently 23% off—or take a chunk off of Apple's Magic Keyboard. This model comes with an 11-inch OLED display, the M5 chip, and two 12MP cameras—one on the front and one on the back.
The Apple Watch SE 3 is the best Apple Watch for most people. Despite the existence of bigger and "better" Apple Watches, the SE 3 does everything most people want their Apple Watches to do. It tracks your workouts, lets you send and receive texts, keeps tabs on your sleep habits, and checks your heart rate. It may be missing perks like an ECG reader, the latest S11 chip, and Apple's new persistent heart rate monitor, but most of us don't need these extra features. What's more, the SE 3 is currently 20% off on Amazon. You can pick up a new SE 3 for as little as $219 for the 40mm model, or $249 for the 44mm option. You can also save on the 44mm cellular option, which is currently $299.
The new Series 12 already has a discount, but unfortunately not for the 42mm option. If you're eyeing the larger model, however, you can spend $399 for the 46mm instead of $449—though it does seem the sales are only for some colors. The Series 12 comes with Apple's latest S12 chip, as well as the new heart rate sensor that takes a reading once every five seconds, or 20 times a minute.
Apple's AirTags are excellent trackers for anyone in the Apple ecosystem. Once set up, you can place AirTags on or in any of your possessions (bags, bikes, keys, etc.) and track those items through Find My. While AirTags cannot connect to the internet themselves, they communicate with other Find My-enabled devices out and about. Those devices then securely and privately update your AirTags' locations. Right now, Amazon is taking $10 off a pack of four, or $5 off an individual AirTag.
People often make fun of Apple's Magic Mouse for its odd charging port location (since it's on the bottom, you can't use the mouse while it's charging) as well as its less-than-ergonomic design. But despite this, it's often the best mouse choice for Mac users, if for no other reason than its easy pairing and compatibility with macOS gestures. If you're looking for a new mouse for your Mac—or even your iPad—you can save 24% on the Magic Mouse at Amazon, bringing the price to $59.99 from $79.
Apple has released updates for iPhones, iPads, and Macs to fix a flaw that could let an attacker run code when a device processes a malicious file. Apple says it may have been used in highly targeted attacks against iPhone users running versions of iOS before iOS 27.
The fix is in iOS and iPadOS 26.7.1, as well as macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1. Check Software Update on each of your Apple devices and install the latest version offered.
Updates for your particular device
The table below shows which relevant updates are available and links to Apple’s security information for each one.
iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
To check if you’re using the latest software version, go to Settings > General > Software Update. You’ll see if an update is available and be guided through installing it.
Turn on Automatic Updates if you haven’t already—you’ll find it on the same screen.
Available update options on iPad
How to update macOS on any version
To update macOS on any supported Mac, use Software Update:
Click the Apple menu in the upper-left corner of your screen.
Choose System Settings (or System Preferences on older versions).
Select General in the sidebar, then click Software Update on the right. On older macOS, look for Software Update directly.
Your Mac will check for updates automatically. If updates are available, click Update Now (or Upgrade Now for major new versions) and follow the on-screen instructions. Before you upgrade to macOS Tahoe 26, read Apple’s instructions.
Enter your administrator password if prompted, then let your Mac finish the update. It may need to restart.
Make sure your Mac stays plugged in and connected to the internet until the update is done.
Technical details
The bug, CVE-2026-86950, affects CoreGraphics, an Apple framework used throughout its operating systems and apps to display and process visual content such as images and PDFs.
It’s an out-of-bounds write issue, which Apple addressed with improved bounds checking. This type of bug happens when software writes data beyond the limits of its allocated area of memory. It can overwrite other data in memory, interfere with the normal operation of the program, cause a crash, or even let an attacker take control of the affected process. In this case, processing a maliciously crafted file may lead to an attacker running their own code.
Apple says it is aware of a report that the issue may have been exploited in an “extremely sophisticated attack” against specific people using versions of iOS before iOS 27. Although the reported attack was highly targeted, other attackers could try to exploit the flaw now that it has been disclosed.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
Apple releases its yearly cluster of operating system updates today, with the two most prominent of course being macOS and iOS/iPadOS. These new versions focus heavily on Apple’s “AI” stuff, but there are a few actual improvements and changes to the actual operating systems as well.
Across both iOS and macOS, users now have a slider to affect how transparent or opaque the “Liquid Glass” design is across the operating system.
And on the macOS side especially, Apple has made numerous small design tweaks to address user feedback, which has been accumulating since Liquid Glass was introduced. There’s nothing radically new in terms of design here, but this is a much-needed polish pass.
Across all the releases, but in particular macOS and also iOS, there are a bunch of quality-of-life or performance improvements. For example, macOS now supports HDR for all system UI elements and gets more robust support for a wider range of display modes for external monitors.
If you’re not into “AI”, there’s not a lot of meat on these bones, but at least you can turn the “AI” nonsense off through a switch buried deep in the settings applications of Apple’s operating systems (which will probably be flicked back on whenever the next update comes).
Do tech companies ever stop to think about the misery they unleash on people’s lives? The Apple Watch Series 12 uses “Audio Intelligence” that, as well as secretly taking notes, also has a Live Rewind feature that can replay the last 15 seconds of recently detected audio and view a text transcript.
So that is the whole pipeline exercised end-to-end. GrandSlam authenticates the Apple Account and obtains the IDS delegate. authenticateDS and id-register turn the Linux process into a registered Apple messaging identity. The Friends sequence attaches that identity to the existing accepted relationship. A missing-key SubscribeAndFetch makes the sharing device deliver its current P-224 key over APNs/IDS, inside a sender-verified P-256 NGM envelope. A second SearchParty fetch returns the encrypted report, and the P-224 key opens it locally.
So yeah, in one sentence: authenticate to Apple’s private services, register the Linux machine as an IDS client, receive the existing Find My share key, and use it to fetch and decrypt a consented friend’s latest location.
I wonder if it would be possible to build a proper third-party client for Apple’s Find My network like this, or if it would be trivial for the company to block it. I’m fairly sure quite a few people would love to be able to keep using Find My when moving away from Apple’s operating systems.
If you thought pervert glasses weren’t bad enough, Apple is taking it up a notch by adding cameras to its AirPods.
Apple is working on camera-equipped AirPods that appear to be nearly ready to launch, based on a video MacRumors found in the macOS Tahoe 26.7 release candidate.
In a short demo, a man holds a book up so the camera in the AirPods can see the title. “With Visual Intelligence, your world becomes savable. See something you like? Just ask me to save it for later,” says the voiceover text.
AirPods are tiny. I’ve seen people use them at the gym. I’ve seen them on playgrounds. I’ve seen them around swimming pools. People use them at the beach. They’re used at schools. In locker rooms. Tiny cameras in tiny AirPods that can photograph anything in front of the user are a pervert’s wet dream. Abusers are going to love this. Why wear bulky glasses anyone can see and try to demand you take off, when you can wear tiny AirPods that have already been fully normalised in society? Was there not a single woman or parent on the team that made this?
All over the United States, people are destroying Flock surveillance cameras. More and more communities are rising up and demanding these things removed from their streets and neighbourhoods. The awareness of just how pervasive mass government surveillance has become is growing, and Silicon Valley’s complicity is not exactly a secret. And in this climate of rapidly growing concern and anger, Apple is going to add tiny cameras to its tiny AirPods. Was there not a single person of colour or protester on the team that made this?
How detached from reality do you have to be to greenlight something like this? Does anyone – regardless of skin colour, gender, or political leaning – want even more cameras around them?
The Touch Bar arrived in 2016 seemingly already pre-doomed, on a generation of machines that had a “we’ve run out of ideas” smell all around them. The arrow keys were reshaped, the keyboard got a slimming down, and even the beloved MagSafe wasn’t, in fact, safe. All of these changes would prove unpopular and get reverted in time, and the axe would eventually come for the Touch Bar, too.
With an enormous benefit of hindsight, a decade after its arrival, and on the (rumored) eve of fully multitouch MacBooks, I wanted to look critically at the Touch Bar in more detail. I put a spicy title above this post, and while I’m not sure I can answer it in the affirmative, I feel I got surprisingly close to that.
I have never spent this much reading about and pondering a technology seemingly nobody liked and that I never really used. I still think there’s merit to the idea of screen on a keyboard, but only if the screens are integrated into the individual keys (as some products have tried over the years). Of course, this would also be astronomically expensive, delicate, and virtually impossible to repair, so I’m not sure something like that can be reasonably made at an affordable price.
The Dutch National Cyber Security Centre (NCSC) issued a warning after being notified of several incidents where a vulnerability in Apple’s Screen Sharing feature was exploited to install Monero cryptominers.
The vulnerability, tracked as CVE-2026-65400, was patched by Apple on August 6. It is an authentication-bypass flaw in macOS Screen Sharing that can let an attacker on the network connect without valid credentials.
macOS’s built-in Screen Sharing service is a remote-control feature commonly associated with port 5900. Successful exploitation can allow a remote attacker on a reachable network to authenticate to the service without legitimate credentials.
Apple said the bug was fixed through “improved state management,” which suggests an authentication-flow or session-state validation failure rather than a cryptographic break.
The patch was issued for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Practical exposure requires Screen Sharing to be enabled, so the highest-risk systems are those where port 5900 is internet-accessible, typically through a router port-forward, public IP assignment, or hosting-provider setup. Hosts reachable only from an internal network are still potentially exposed, but attackers would have to gain a position on that network.
An attacker could view and control the Mac remotely because that is the function Screen Sharing provides. NCSC says active cases involved attackers gaining root access and installing cryptomining software, specifically for Monero mining.
The criminals likely chose Monero mining because it does not depend on heavily specialized, application-specific integrated circuits (ASICs), but can be done with any CPU or GPU.
Cryptomining isn’t necessarily the worst an attacker could do. With a root-level compromise an attacker could enable persistence, data theft, credential and key harvesting, deployment of additional malware, and lateral movement.
How to stay safe
Install the update
The best way to protect your Mac is to install the update.
To update macOS on any supported Mac, use the Software Update feature, which Apple designed to work consistently across all recent versions. Here are the steps:
Click the Apple menu in the upper-left corner of your screen.
Choose System Settings (or System Preferences on older versions).
Select General in the sidebar, then click Software Update on the right. On older macOS, just look for Software Update directly.
Your Mac will check for updates automatically. If updates are available, click Update Now (or Upgrade Now for major new versions) and follow the on-screen instructions. Before you upgrade to macOS Tahoe 26, please read these instructions.
Enter your administrator password if prompted, then let your Mac finish the update (it might need to restart during this process).
Make sure your Mac stays plugged in and connected to the internet until the update is done.
Make sure Screen Sharing is disabled
If you can’t update immediately, check whether Screen Sharing is enabled and turn it off if you don’t use it.
Click the Apple menu in the top-left corner of the screen.
Select System Settings.
In the left sidebar, click General.
Click Sharing on the right; you may need to scroll down.
Find Screen Sharing:
If the switch is off/grey, it is disabled.
If the switch is on/colored, click it to switch it off.
Also check Remote Management on that same Sharing page. It provides another remote-control route and should be off unless the owner knowingly uses it for work or IT support.
Apple now shows a warning directly on an iPhone’s Lock Screen and in Settings when it believes the device owner has been targeted by mercenary spyware. The new on-device alert is meant to make a high-risk warning harder to overlook and complements notifications by email and through the user’s Apple Account page.
In the explanation, Apple states:
“Apple threat notifications are high-confidence alerts that a user has been individually targeted by a mercenary spyware attack, and should be taken very seriously.”
“Apple Threat Notification Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to help protect your data and device.”
Apple says its threat notifications are intended for people individually targeted by mercenary spyware attacks, which are highly sophisticated campaigns usually associated with commercial surveillance vendors and their government customers. Apple says it has notified targets in over 150 countries since the launch of the program in 2021, while the latest round of notifications reached people in 110 countries.
Mercenary spyware campaigns are usually not aimed at the average iPhone owner—at least at first. The initial targets are often people selected for who they are, what they know, or the work they do. But it would be a mistake to view this as someone else’s problem.
Attack techniques developed for narrowly targeted operations have a habit of spreading. Exploits can be reused, sold onward, reverse engineered, copied by other surveillance vendors, or adapted by criminal groups. A vulnerability initially valuable because it compromises a small number of carefully chosen devices may become much more dangerous once public disclosure, patch analysis, or exploit sharing makes them available for more widespread campaigns.
How to stay safe
Apple advises users to:
Update your devices to the latest software, which includes the latest security fixes.
Protect your devices with a passcode, Touch ID, or Face ID.
Use strong and unique passwords, and passkeys where available.
Don’t open links or attachments from unknown senders.
We’d like to add:
Potential targets of mercenary spyware should consider applying Apple’s Lockdown Mode.
Check if an Apple Threat Notification is real. Scammers will undoubtedly try and mimic them. You can verify a notification by signing in to your Apple account. A genuine Threat Notification will always be clearly listed there.
If you receive an Apple Threat Notification, Apple recommends seeking expert help, such as the Digital Security Helpline from Access Now.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
The European Union’s Digital Markets Act keeps delivering for EU citizens.
Apple is working on a new feature that will support cross-device copy and paste between iOS devices and Windows PCs.
Microsoft asked for the feature using Apple’s EU interoperability request system for developers, which Apple implemented to comply with the Digital Markets Act. Apple began evaluating the request in March, and on June 26, proposed a project plan.
According to Apple, this minor feature is going to cost Apple “significant engineering effort”; I’d estimate it’ll cost them about one to two golden statues.
If you’ve spent any time browsing lately, you may have run into a full-screen popup warning you that your Apple ID or Amazon account was just used for a mysterious $149.99 purchase. It looks urgent. It looks official. And if you look at two examples side by side, it becomes obvious that it’s neither.
Below are two popups pulled from real pages—one dressed up as Apple Support, one as Amazon.
Same con, two costumes
Below, one popup is skinned as Apple Support, the other as Amazon. Swap the logo and color palette and the structure is identical: a warning icon, a claim that a $149.99 purchase was just made “via Pre-Authorization,” and a phone number to call immediately. That phone number is exactly the same in both.
Fake Apple alertFake Amazon alert
That reused phone number is the tell. If you only see one popup, running the number through a lookup tool like Malwarebytes Scam Number Check is usually enough to expose it—a real Apple or Amazon line won’t come back flagged, but a scam number typically does, often tied to complaints about several unrelated companies at once.
Why the copy is built the way it is
Every element in these popups is doing specific psychological work:
A believable, moderate dollar amount. $149.99 is high enough to alarm you, low enough to sound like a real subscription or product charge rather than an obvious lie.
“Pre-Authorization” jargon. This is real payment terminology (used for things like hotel holds or gas station charges), borrowed here to sound technically credible to someone who doesn’t handle payments professionally.
Manufactured urgency. “Call immediately,” “Immediate Action Required,” “no hold times”—all are designed to get you dialing before you stop to verify anything.
Visual authority. Red warning triangles, brand-matching fonts and layouts, and a full-screen modal that blocks the rest of the page all borrow the visual language of legitimate security alerts.
A single, frictionless call to action. One button, one phone number. The popup wants exactly one thing from you: to pick up the phone.
If you do call, the number connects to a live scammer posing as support staff, whose actual goal is to get remote access to your device, walk you through “verifying” your identity in a way that hands over real account or payment info, or push you toward paying a fake fee—often via gift cards or a wire transfer.
How to tell if it’s fake
A few checks work regardless of which brand is being impersonated:
Real companies don’t alert you this way. Apple and Amazon notify you about account activity through email, in-app notifications, or your account’s activity log—never through an unexpected popup while you’re browsing.
No legitimate company tells you to call a phone number to stop a charge. Disputing a charge happens through your bank, your card issuer, or the company’s actual account dashboard—not a hotline dictated by a popup.
Check where the popup is actually served from. These often ride in on malicious ads, compromised sites, or browser redirects—the underlying page may be spoofed or injected, not the real apple.com or amazon.com support page it appears to sit on top of.
A popup you can’t easily close is a red flag on its own. Legitimate sites don’t need to trap you behind a full-screen modal to relay account information.
If in doubt, go direct. Close the tab (force-close via task manager if needed) and navigate to the company’s site yourself, or call the number printed on your card or official account page—never the one in the popup.
Check the number before you dial it. Run it through Malwarebytes Scam Number Check to see if it’s already been flagged as a scam line.
Block it before it loads. A browser extension like Malwarebytes Browser Guard catches both known malicious pages and unknown ones showing scam-like behavior, so these popups often get stopped before they ever render.
Don’t judge a scam by its logo
The brand on screen—Apple, Amazon, or whoever’s next—is the least important part of this scam. What actually matters is the pattern underneath: an unexpected popup, a suspiciously specific dollar amount, urgent language, and a phone number that wants you to call before you think. Once you recognize that pattern, it doesn’t matter which company’s name is stamped on top of it.
The UK Home Office has once again demanded Apple allows it access to encrypted iCloud data.
The Guardian reports that the Home Office issued a Technical Capability Notice to Apple, this time targeting only British users. A Technical Capability Notice is a formal government order that compels tech and telecommunications companies to build or maintain specific technical functions—such as intercepting data or removing encryption protections—so law enforcement can access communications.
In the last round of this ongoing battle, the UK secretly ordered Apple to provide blanket access to protected iCloud backups around the world. Advanced Data Protection (ADP) is Apple’s opt‑in end‑to‑end encryption for iCloud backups, which even Apple itself cannot read. Apple argued that weakening or removing ADP would expose users to data breaches and other threats, and instead chose in January 2025 to withdraw ADP for UK customers rather than build a backdoor, while leaving it available elsewhere.
So, instead of working to keep citizens safe and secure, the Home Office just ended up removing an option for them.
Apple has responded by lodging a complaint with the Investigatory Powers Tribunal (IPT), seeking to challenge the scope and lawfulness of the government’s powers to issue such notices under the Investigatory Powers Act. The Tribunal is an independent court that has the power to investigate claims that the UK intelligence services have acted unlawfully.
Privacy International and Liberty have parallel complaints at the IPT challenging Technical Capability Notices more broadly, including their secrecy and necessity, and have asked for Apple’s claim to be heard in public given its wide public-interest implications.
I feel the fear of leaving an intentional backdoor is justified. If it exists, there is a chance that (AI-assisted) criminals will find and exploit it.
Weighing the importance of the right to privacy and the ability to investigate cases including terrorism and child sexual abuse is not easy. Apple’s ADP is used by many and as soon as criminals would know it’s no longer safe for them to use, they’d move to other platforms. Platforms where no legislative power will be able to gain access.
But, given the danger of a backdoor becoming available for criminals, we think in this case privacy should prevail. Let us know how you feel in the comments.
Browse like no one’s watching.
Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free →
Cameron Kaiser’s articles are always a right treat, and this one’s no different. It’s about running MkLinux on the Apple Workgroup Server, the regular Mac rebadged into a server product and predecessor to Apple’s first real server product, the Apple Network Server running AIX. The Workgroup Servers were originally marketed with Apple’s UNIX variant, A/UX, but with this operating system not surviving the transition to PowerPC processors, Apple started offering other options.
A/UX ultimately didn’t survive the 1994 68K transition to PowerPC, but in 1996 Apple publicly offered another option: run Linux, using the Mach microkernel. Although MkLinux emerged after the 9150’s discontinuation, it’s still just an overgrown NuBus Power Mac, so between more RAM, a beefier CPU upgrade and various video cards, by the end of this article we ought to have a configuration that gives us the best of two worlds — classic MacOS and MkLinux — in one server.
I never really stopped to think that MkLinux really was, but it’s a lot more interesting than just an early Linux port to PowerPC Macs. In fact, it ran the monolithic Linux kernel as a userspace process on top of the Mach microkernel, which made it a valuable testing ground for Apple’s later XNU efforts. It’s wild that Apple had an official, blessed Linux operating system as early as the mid ’90s, even if its performance was apparently not particularly great – due to the overhead of running it atop Mach – and Jobs canned it as soon as he came back to the company.
Apple has shipped a hefty round of July security patches, headlined by iOS/iPadOS 26.6, macOS Tahoe 26.6, and Safari 26.6, with dozens of vulnerabilities squashed across kernel, WebKit, media frameworks, and core apps. These updates are primarily about improving security rather than adding new features, and users should install them as soon as possible.
Updates for your particular device
The table below shows which updates are available and points you to the relevant security content for that subject.
iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
For iOS and iPadOS users, here’s how to check if you’re using the latest software version:
Go to Settings > General > Software Update. You will see if there are updates available and be guided through installing them.
Turn on Automatic Updates if you haven’t already—you’ll find it on the same screen.
How to update macOS on any version
To update macOS on any supported Mac, use the Software Update feature, which Apple designed to work consistently across all recent versions. Here are the steps:
Click the Apple menu in the upper-left corner of your screen.
Choose System Settings (or System Preferences on older versions).
Select General in the sidebar, then click Software Update on the right. On older macOS, just look for Software Update directly.
Your Mac will check for updates automatically. If updates are available, click Update Now (or Upgrade Now for major new versions) and follow the on-screen instructions. Before you upgrade to macOS Tahoe 26, please read these instructions.
Enter your administrator password if prompted, then let your Mac finish the update (it might need to restart during this process).
Make sure your Mac stays plugged in and connected to the internet until the update is done.
How to update your Safari browser
Safari updates are included with macOS updates, so installing the latest version of macOS will also update Safari. To check manually:
Open the Apple menu > System Settings > General > Software Update.
If you see a Safari update listed separately, click Update Now to install it.
Restart your device when prompted.
If you’re on an older macOS version that’s still supported (like Sonoma or Sequoia), Apple may offer Safari updates independently through Software Update.
Technical details
Among the more interesting vulnerabilities patched in this update are CVE-2026-43818 in ImageIO, CVE-2026-43776 in AppleDouble, and CVE-2026-64763 to 64766 in SceneKit.
Although found in different applications, these vulnerabilities have one thing in common. Their descriptions say:
“Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.”
The identical “processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution” language is not a coincidence. It’s Apple’s standard impact boilerplate for file‑parsing bugs across multiple frameworks, including ImageIO, AppleDouble, and SceneKit. The similarities reflect shared exploitation patterns (untrusted file input hitting native parsers), while the differences lie in what each framework does and which file types/contexts are affected.
ImageIO is the system framework responsible for reading and displaying image formats such as JPEG, PNG, TIFF, RAW, GIF, and other formats. It’s used throughout iOS and macOS by apps including Photos, Safari, Messages, Mail, and Preview.
SceneKit is a 3D graphics and scene graph framework used for rendering models, animations, and complex 3D scenes in apps and games on Apple platforms. It parses scene description files and 3D assets and turns them into renderable content.
AppleDouble is something macOS uses behind the scenes to keep extra file information like icons and other Finder details in cases where your files live on certain types of disks or servers. When Apple mentions “AppleDouble” in security notes, it’s talking about the code that reads and writes that hidden metadata, particularly when files are stored on network drives or shared with non‑Apple systems.
Apple’s advisories reuse a standard warning for any memory‑corruption bug in a file parser: the best‑case outcome is just a crash, the worst case is someone running their malicious code on your device. ImageIO, AppleDouble, and SceneKit all sit in that same danger zone. Although the file types are different, they all present the same underlying risk.
Until you’ve installed this update, it’s an even worse idea than usual to open unsolicited messages and emails with images in them.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
Millions of drivers with a dealer-installed KARR Security System are being urged to update their KARR alarm using an iPhone or Android device after researchers uncovered a Bluetooth vulnerability that could allow nearby attackers to unlock or immobilize affected vehicles. The flaw impacts more than 2.2 million vehicles equipped with the aftermarket security system, but it does not affect factory-installed vehicle software, Apple CarPlay or Apple's iPhone platform.
KARR Security System Vulnerability Affects Dealer-installed Hardware
The KARR Security System is installed by dealerships to secure vehicles on their lots. In many cases, the hardware remains connected even after buyers decline the paid KARR alarm service. Because it is third-party equipment, automakers cannot deliver fixes through their standard software update process.Researchers from the University of California, San Diego found that attackers within Bluetooth range could lock or unlock vehicles, disable alarms, activate horns, flash lights, or prevent parked vehicles from starting. However, they confirmed the flaw cannot remotely start a vehicle or control it while driving.
iPhone App Update Fixes KARR Alarm Flaw
Acrisure Protection Group, which sells the KARR Security System, released a firmware update on July 20 after researchers privately disclosed the issue in January 2025. Owners using the KARR Security app on an iPhone should receive an update notification. Others must download the app, connect it to the KARR alarm, then navigate to "Customer Service" and "Firmware Update."The patch was released before presentations scheduled for DEF CON on August 9 in Las Vegas and the USENIX Security Symposium on August 12 in Baltimore.
Hidden KARR Security System Complicates Updates
Researchers estimate at least half of affected owners never requested the KARR Security System. Dealerships often left deactivated hardware installed, yet researchers found these units continued broadcasting Bluetooth signals while vehicles were running and for up to 10 minutes after being switched off.Owners can identify the system by checking for a KARR or "SWDS" sticker on the driver's window or a blinking button beneath the dashboard. Most affected vehicles were purchased from Honda, Toyota, Mazda, Ford and Jeep dealerships in Southern California between 2017 and July 21, although impacted vehicles were also identified elsewhere.
Shared Bluetooth Key Exposes KARR Alarm Devices
Researchers discovered a universal authentication key embedded in the official smartphone app while reverse engineering Bluetooth communications. Using a proof-of-concept Android app, they unlocked vehicles, disabled KARR alarm functions, and triggered horns and lights.Although the flaw alone cannot steal a vehicle, researchers said it could provide quiet access before a commercially available locksmith tool creates a working key. Acrisure described the attack as "highly complex" and said the real-world risk is low. Neither UC San Diego nor Wired found evidence of criminals exploiting the vulnerability.
Privacy Concerns and Recommended Action
Researchers also warned that Bluetooth signals from the KARR Security System could reveal vehicle locations. Using the WiGLE wireless database, they estimated at least 2.2 million Bluetooth-enabled systems had been deployed and detected 97 KARR-equipped vehicles during a 20-minute drive near the UC San Diego campus.Drivers should confirm whether their vehicle contains a KARR Security System, install the latest firmware using the iPhone or Android app, and contact their dealership or KARR support if they cannot complete the update.
Artificial intelligence platforms may be just as susceptible to social engineering as human beings, but they are proving remarkably good at finding security vulnerabilities in human-made computer code. That reality is on full display this month with some of the more widely-used software makers — including Apple, Google, Microsoft, Mozilla and Oracle — fixing near record volumes of security bugs, and/or quickening the tempo of their patch releases.
As it does on the second Tuesday of every month, Microsoft today released software updates to address at least 118 security vulnerabilities in its various Windows operating systems and other products. Remarkably, this is the first Patch Tuesday in nearly two years that Microsoft is not shipping any fixes to deal with emergency zero-day flaws that are already being exploited. Nor have any of the flaws fixed today been previously disclosed (potentially giving attackers a heads up in how to exploit the weakness).
Sixteen of the vulnerabilities earned Microsoft’s most-dire “critical” label, meaning malware or miscreants could abuse these bugs to seize remote control over a vulnerable Windows device with little or no help from the user. Rapid7 has done much of the heavy lifting in identifying some of the more concerning critical weaknesses this month, including:
CVE-2026-41089: A critical stack-based buffer overflow in Windows Netlogon that offers an attacker SYSTEM privileges on the domain controller. No privileges or user interaction are required, and attack complexity is low. Patches are available for all versions of Windows Server from 2012 onwards.
CVE-2026-41096: A critical RCE in the Windows DNS client implementation worthy of attention despite Microsoft assessing exploitation as less likely.
CVE-2026-41103: A critical elevation of privilege vulnerability that allows an unauthorized attacker to impersonate an existing user by presenting forged credentials, thus bypassing Entra ID. Microsoft expects that exploitation is more likely.
May’s Patch Tuesday is a welcome respite from April, which saw Microsoft fix a near-record 167 security flaws. Microsoft was among a few dozen tech giants given access to a “Project Glasswing,” a much-hyped AI capability developed by Anthropic that appears quite effective at unearthing security vulnerabilities in code.
Apple, another early participant in Project Glasswing, typically fixes an average of 20 vulnerabilities each time it ships a security update for iOS devices, said Chris Goettl, vice president of product management at Ivanti. On May 11, Apple shipped updates to address at least 52 vulnerabilities and backported the changes all the way to iPhone 6s and iOS 15.
Last month, Mozilla released Firefox 150, which resolved a whopping 271 vulnerabilities that were reportedly discovered during the Glasswing evaluation.
“Since Firefox 150.0.0 released, they have been on a more aggressive weekly cadence for security updates including the release of Firefox 150.0.3 on May Patch Tuesday resolving between three to five CVEs in each release,” Goettl said.
The software giant Oracle likewise recently increased its patch pace in response to their work with Glasswing. In its most recent quarterly patch update, Oracle addressed at least 450 flaws, including more than 300 fixes for remotely exploitable, unauthenticated flaws. But at the end of April, Oracle announced it was switching to a monthly update cycle for critical security issues.
On May 8, Google started rolling out updates to its Chrome browser that fixed an astonishing 127 security flaws (up from just 30 the previous month). Chrome automagically downloads available security updates, but installing them requires fully restarting the browser.
If you encounter any weirdness applying the updates from Microsoft or any other vendor mentioned here, feel free to sound off in the comments below. Meantime, if you haven’t backed up your data and/or drive lately, doing that before updating is generally sound advice. For a more granular look at the Microsoft updates released today, checkout this inventory by the SANS Internet Storm Center.
Login
