Archives August 2026

Photoshop’s “Remove background” tool is great, but it comes with a pretty steep price. To use it, you need an active subscription.

Even as August’s newest movies and TV show titles trickle in on HBO Max, for documentary enthusiasts, one new series that’s been building some excitement has finally arrived, and I can confirm after watching the first episode that it’s been well worth the wait.

Documentary fans have been treated to some pretty great stuff on Netflix lately, with a couple of chilling true-crime titles burning up the Top 10 charts in the U.S. recently—The Idaho Murders: College Nightmare and A Toxic Love Story—both of which we’ve covered in this weekly recommendation list. With August now upon us, though, the streaming giant isn’t letting you off the hook just yet.

Three WebKit mechanisms have been discovered to bypass Apple’s iCloud Private Relay. In fact, the mechanisms can bypass any browser?level proxy configuration, including Psylo’s proxy, Tor-on-iOS proxy setups, and so on.

Private Relay is a VPN-like system for Safari on iOS which is meant to prevent websites from viewing the visitor’s IP address and location.

But because all three methods described by the researchers occur outside WebKit’s normal page loading path, Apple’s iCloud Private Relay never sees them and, as a result, means you can’t hide your IP address or Domain Name System (DNS) path in these cases.

The three features are:

• DNS prefetching
  Modern browsers try to be faster by looking up the IP addresses of links on a page before you click them, a feature known as DNS prefetching. In WebKit, these DNS lookups can bypass the configured proxy/relay and go straight through the system’s normal DNS stack, exposing which DNS servers you are using and, indirectly, where you really are. Even if the actual page load goes through Private Relay, the prefetch DNS queries can still leak metadata about your network.
• WebAuthn and passkeys
  WebAuthn (the standard behind passkeys) sometimes needs to fetch a small file from the website’s domain to verify that the credential is being used on the right site. The researchers found that, on Apple platforms, this fetch is performed outside the usual WebKit page?loading path, which means it is not sent through the Safari proxy or Private Relay. The result is that a site using passkeys can cause your device to contact it directly, revealing your true IP address even if the rest of your browsing is supposedly hidden behind a relay.
• WebTransport and related technologies
  WebTransport is a newer API that gives websites a way to open low?latency, bidirectional connections to a server. In the scenarios the researchers tested, these WebTransport connections were also initiated outside the proxied WebKit code path, creating another route for sites to receive traffic straight from the device. That traffic again carries the device’s real IP, not the relay or proxy IP the user expects.

From a user?experience point of view, the problem is that all three mechanisms look like normal browser behavior and require no special tricks from a malicious site.

What’s affected

Affected are Safari on iOS and macOS when Private Relay is used, because Private Relay is implemented as a WebKit?level proxy that only applies to Safari traffic. Additionally, any iOS/macOS browser or app that relies on WebKit’s proxy configuration to hide the IP (e.g., Psylo, Onion Browser/Tor on iOS, and other proxy browsers), since they all hit the same WebKit behavior.

And that’s not necessarily all. For most of iOS’s history, any app that browsed the web had to use Apple’s WebKit framework and JavaScript engine. This meant that Chrome, Firefox, Edge, Brave, and other browsers on iPhone were effectively different shells around the same WebKit engine Safari uses. Under pressure from the EU’s Digital Markets Act (DMA), Japan’s Smartphone Act, and similar regulatory pushes, Apple introduced a mechanism for non?WebKit engines, but only in constrained ways.

Malwarebytes’ Senior manager for iOS software Roman Dvoinev commented:

“Basically the API has been “open” for a while, but no browser vendor has actually shipped a non-WebKit browser yet. Major players are still in prototype phase, as Apple’s bar for shipping a browser to iOS is very high.”

Malwarebytes VPN is not affected, since it tunnels the device’s entire network traffic at the system level.

The researchers have reported the problems to Apple and are expecting patches by fall.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free ? 

Ford is finally ready to share tangible details of its affordable electric pickup truck. The automaker has revealed that the EV will carry the Fathom name and a starting price of $28,350 when equipped with a “standard-range” battery.

We’ve all heard that 5GHz Wi-Fi is better, so the logical conclusion would be to just let everything use 5GHz, right? Nope. Not so much.

AI did not create a new browser security problem. It exposed one that enterprises have long been able to ignore. Skyhigh Security explains why browsers have become a critical control point for governing data movement, AI interactions, and modern work. […]

**A Week in Security: Threats and Alerts from Malwarebytes Labs**

As a dedicated computer specialist, I’m always on the lookout for the latest security threats and trends. In this article, we’ll take a closer look at some of the key security stories from last week, courtesy of Malwarebytes Labs.

**Fake Fortnite Rewards Scam**

Malwarebytes Labs recently exposed a scam targeting Fortnite players. Scammers were using fake rewards to steal players’ accounts. If you’re an avid gamer, be cautious when receiving unsolicited login requests or reward notifications.

Source: [Malwarebytes Labs](https://www.malwarebytes.com/blog/2026/07/fake-fortnite-rewards-are-stealing-players-accounts)

**Fake Flash Player Installs AtlasRAT**

Another threat caught our attention last week. A fake Flash player installation was used to deliver the malicious AtlasRAT malware. Make sure to only download software from trusted sources, and be wary of unsolicited pop-ups or ads.

Source: [Malwarebytes Labs](https://www.malwarebytes.com/blog/2026/07/fake-flash-player-installs-atlasrat)

**Microsoft Copilot AI Worm**

A recent discovery revealed a hidden prompt that turns Microsoft Copilot into an AI worm. This highlights the importance of staying vigilant when interacting with AI-powered tools.

Source: [Malwarebytes Labs](https://www.malwarebytes.com/blog/2026/07/hidden-microsoft-copilot-ai-worm)

**Fake Crypto App Steals $1.8 Million**

Apple has been accused of allowing a fake crypto app to steal over $1.8 million from users. This serves as a reminder to always be cautious when dealing with suspicious apps and transactions.

Source: [Malwarebytes Labs](https://www.malwarebytes.com/blog/2026/07/apple-accused-of-letting-fake-crypto-app-steal-1-8-million)

**Buying TikTok Views or Followers? What You’re Really Getting**

The dark side of social media has been exposed. Buying views or followers on platforms like TikTok can lead to unwanted exposure to malware and scams.

Source: [Malwarebytes Labs](https://www.malwarebytes.com/blog/2026/07/buying-tiktok-views-or-followers-heres-what-youre-really-getting)

**AI Robocalls: Why Caller ID is Still Lying to You**

Even with caller ID, you can still be targeted by AI-powered robocalls. Stay vigilant and don’t engage with suspicious calls or messages.

Source: [Malwarebytes Labs](https://www.malwarebytes.com/blog/2026/07/ai-robocalls-why-caller-id-is-still-lying-to-you)

**Protecting Your Data: What You Need to Know**

In today’s digital landscape, it’s essential to prioritize data security. Malwarebytes Mobile Security is here to help protect you from phishing, scam texts, malicious sites, and more.

Source: [Malwarebytes Labs](https://www.malwarebytes.com/mobile)

**Download Malwarebytes Mobile Security Today!**

Stay safe online with real-time AI-powered Scam Guard built right in. Download for iOS or Android now!

[Download for iOS ?](https://www.malwarebytes.com/ios)
[Download for Android ?](https://www.malwarebytes.com/android)

By staying informed and taking the necessary precautions, you can protect yourself from the latest security threats.

Stay safe!