❌

Normal view

MacVoices #26283: Live! – ‘Pro and Tell,’ Duo Delays, Apple at $5 Trillion, and Affinity for iPad

By: Chuck
21 October 2026 at 22:21
Apple’s upcoming “Pro and Tell” event sparks speculation about new MacBook Pro models, while iPhone Duo preorders raise questions about shipping delays and retail availability. The panel discusses Apple’s $5 trillion valuation, why HomeView won’t launch in the European Union, and the anticipated arrival of Affinity Studio on iPad, including how it could transform creative workflows and provide yet another powerful alternative to Adobe Creative Cloud. 

💾

MacVoices #26281: Live! – Photocraft and the Rise of AI-Created Software Alternatives

By: Chuck
19 October 2026 at 19:25
Can AI-powered vibe coding challenge established software companies? Photocraft and other Adobe application clones spark a discussion of their capabilities, legal questions, and the possibility of creating customized software. A live download offers a closer look at the applications. The conversation also explores the Swift Angels developer meetup, LinkedIn’s growing importance for professional networking, and generational differences in technology.

💾

October Patch Tuesday: 1,408 CVEs, 1 exploited flaw and a SharePoint surprise

16 October 2026 at 18:00

Microsoft’s October 2026 Patch Tuesday is the year’s largest release, with 1,408 CVEs requiring customer action, 72 of them rated critical. September, the previous high, carried 963. One CVE is already exploited: CVE-2026-96951, a Windows Shell flaw that bypasses Mark of the Web. Two were publicly disclosed before release, in the .NET Framework and the MessagePack-CSharp library. Separately, on 25 September Microsoft reported attacks against CVE-2026-65660, a SharePoint Server flaw fixed in August. Readiness recommends a Patch Now scheduling for Windows, Office, Exchange and the developer tooling, and a standard release schedule for SQL Server. The Readiness team has published an infographic summarising deployment risk by product family.

Known issues

On 14 October, Microsoft added a known issue to this month’s Windows 11 updates, KB5127648 for versions 24H2, 25H2 and 26H2, and KB5127646 for 26H1. Non-admin users might be unable to open Remote Desktop connections to devices that have Administrator protection enabled, with error 0xC000000D. The issue started with September’s non-security preview update. The Windows 11 security baselines enable Administrator protection by default, so test remote access to managed hosts before broad deployment. Microsoft’s mitigation is to turn off Administrator protection temporarily through your policy management tool, and a fix will follow in a future update.

Two issues remain open:

  • Some USB Audio Class 1.0 devices might fail to start or produce no sound. The 14 September out-of-band update resolved part of this, and for the remaining symptoms Microsoft directs IT administrators to Microsoft Support for Business.
  • Windows Server Update Services still does not display synchronisation error details on Server 2025 and Server 2022. Microsoft removed the function to address CVE-2025-59287 and offers no workaround.

And three are now closed:

  • The incorrect “Microsoft Defender Antivirus is turned off” notifications, still open when we published in September, were fixed by Defender Antivirus update 4.18.26080.4, released on 17 September.
  • On Windows 11, the October update fixes Explorer failing to start after sign-in on multi-user systems such as Azure Virtual Desktop with FSLogix, which left users at a black screen.
  • On Windows 10, Windows 11 23H2 and Server 2016 and 2019, it fixes File History failing to back up or restore and showing a false “Reconnect your drive” message.

Major revisions and mitigations

Between the September and October releases, from 9 September to 12 October, Microsoft’s Security Update Guide notifications covered 111 entries for Microsoft’s own products, not counting Chromium republications for Edge. Of those 111, 90 are true revisions rather than new entries. September’s window had one.

  • On 17 September, 84 of September’s CVEs gained Office for Mac updates. Each revision note tells customers running affected Mac software to “install the update for their product to be protected”.
  • On 16 September, Microsoft corrected the scoring of three critical SQL Server remote code execution flaws from September, CVE-2026-67378, CVE-2026-67631 and CVE-2026-67643. The scores now record that “an attacker does not require any privileges”. Microsoft calls this an informational change.
  • On 25 September, Microsoft revised CVE-2026-65660, a SharePoint Server remote code execution flaw fixed in August, to state that it “had reliable evidence of observed attacks against exploitation of this vulnerability”. CISA added it to its list of known exploited vulnerabilities the same day. The Security Update Guide still shows “Exploited: No” for this CVE, so a report filtered on that flag will miss it. If any SharePoint server lacks the August update, install it now.
  • Of the 21 new entries, 18 are critical cloud-side flaws in Azure, Microsoft 365 Copilot, Dataverse and Fabric, all marked “Customer action required: No”. Two are Edge flaws, and one is CVE-2026-96940 in Exchange Server, published on 2 October and covered below.

Microsoft has published no mitigations and no workarounds in the October release.

Windows lifecycle and enforcement updates

These support milestones passed with this release on 13 October, as scheduled:

The next milestones fall on 10 November 2026, the date of November’s Patch Tuesday. .NET 8 and .NET 9 reach the end of support, as do PowerShell 7.4 and 7.5. Windows 11 Enterprise and Education 23H2, and IoT Enterprise 23H2, reach the end of updates, and Microsoft says November’s update “will be the last update available for these editions”.

Microsoft also starts or tightens several enforcement changes with this release:

  • Windows 11 24H2, 25H2 and 26H2, and Windows Server 2025, now restrict NTLMv1-derived credentials for single sign-on by default. Where Credential Guard is off, Microsoft warns this “might affect Wi-Fi, Ethernet and VPN connections that use MS-CHAPv2-based authentication” (KB5066470).
  • AD FS Distributed Key Manager container permissions move into enforcement mode. Supported servers remediate automatically, but Server 2012 and 2012 R2 need manual remediation (KB5121391).
  • ReFS volumes on removable media enter an audit phase, and blocking is enabled by default from the January 2027 update (KB5130741).
  • The Windows Production PCA 2011 Secure Boot certificate, used to sign the Windows boot loader, expires on 19 October. Devices without its replacement, Windows UEFI CA 2023, keep starting and updating normally, but they stop receiving new early-boot protections (KB5062710).

Microsoft’s test guidance for this release runs to 496 Windows entries, 41 of them flagged as high risk, against 466 and 55 in September. Printing, scanning and font rendering account for 31 of the 41. The Readiness team recommends these testing priorities:

  • Printing. Print documents with mixed fonts from 32-bit and 64-bit applications to physical and virtual printers. Add network printers by discovery and by IP address, and print through a shared print server, a USB printer and a PostScript driver.
  • Downloaded files. The exploited Shell flaw bypasses Mark of the Web, so open files and shortcuts downloaded from the internet and confirm the SmartScreen and security warnings still appear.
  • Remote access. Test Remote Desktop with a non-admin account against hosts that have Administrator protection enabled, and test Wi-Fi and VPN connections that use MS-CHAPv2.
  • Application installs. Install, repair and uninstall a representative set of MSI packages, including packages with script custom actions. Windows Installer takes 38 fixes this month.
  • Network servers. Run DNS servers (52 fixes) and DHCP servers (18) under load, and confirm leases, zone transfers and conditional forwarders behave as before.

Each month, we break down the update cycle into product families, as defined by Microsoft, with the following groupings.

Browsers

For the third month in a row, Microsoft’s Patch Tuesday release lists no browser CVEs. Edge security fixes arrived between releases instead. Between 9 September and 12 October, Microsoft published 414 CVEs for Microsoft Edge in the Security Update Guide: 409 republished from Chromium and five specific to Edge. None carries an exploited flag, and no Edge release in that period reported an exploit in the wild.

Microsoft Windows

Windows takes 1,122 CVEs this month, 42 of them critical. Elevation of privilege accounts for 617 entries, information disclosure for 200 and remote code execution for 179. Of the 42 critical entries, 31 are remote code execution, nine are elevation of privilege and two are spoofing.

  • The exploited flaw is CVE-2026-96951, a Windows Shell security feature bypass that evades Mark of the Web defences. An attacker must convince a user to open a crafted file or follow a link. CISA added it to its list of known exploited vulnerabilities on 13 October, with a remediation date of 16 October.
  • DHCP takes 18 fixes, six of them critical remote code execution: five in DHCP Server and one in the DHCP client. DNS Server takes 52, 10 of them remote code execution, though none is critical. Critical remote code execution also affects Hyper-V, Message Queuing, Microsoft QUIC, the Remote Desktop Gateway, Windows Deployment Services, Active Directory Domain Services, NDES and the multicast transport driver.
  • In file and image handling, the Raw Image Extension has three critical fixes, one of them a CVE assigned by Cisco Talos, and the PostScript printer driver takes three more. Text shaping takes two, and Media Foundation, the codecs library, the video decoder, GDI+, the graphics component and the Windows PDF component take one each.
  • The virtualisation-based security enclave takes eight fixes, five of them critical elevation of privilege.
  • The most-patched areas are DNS Server at 52, Win32k at 48, the Windows Kernel at 46 and Windows Installer at 38.

Add this Windows update to your Patch Now schedule. Every client needs the fix for the exploited Shell flaw, and DHCP servers and Hyper-V hosts need the critical server-side fixes.

Microsoft Office

Microsoft released 180 Office CVEs this month, 26 of them critical, and remote code execution accounts for 107.

  • Client updates on Windows are Click-to-Run only, for Microsoft 365 Apps, Office LTSC 2021 and Office LTSC 2024. Office for Mac updates ship in the same release this month, rather than nine days later as they did in September. Excel takes 69 fixes, 11 of them critical. Word takes 22, Access 13, Outlook 10 with five critical, PowerPoint nine with four critical, and Visio three, all critical.
  • SharePoint Server Subscription Edition takes 34 CVEs in KB5002927, two of them critical. SharePoint Server 2016 and 2019 left extended support on 14 July 2026, and two of this month’s flaws list them as affected with no update: CVE-2026-69943 for both versions and CVE-2026-97783 for 2019.
  • Office Online Server takes 43 CVEs in KB5002928. Skype for Business Server takes three, in KB5132779 for 2015 CU13, KB5131693 for 2019 CU8 and KB5131692 for Subscription Edition CU1.

Add these updates to your Patch Now schedule, because 25 of the 26 critical entries affect Excel, Outlook, PowerPoint, Visio and Word.

Microsoft Exchange and SQL Server

Exchange has one critical entry this month and SQL Server has none.

  • Exchange Server has seven CVEs across 2016 CU23, 2019 CU14 and CU15, and Subscription Edition: one critical remote code execution, CVE-2026-70571, five elevations of privilege and one spoofing flaw. Six are fixed by the 13 October updates: KB5128895 for Subscription Edition, KB5128896 for 2019 CU15, KB5128897 for 2019 CU14 and KB5128898 for 2016 CU23.
  • The seventh, CVE-2026-96940, was published on 2 October. Microsoft lists it against a separate set of updates released that day, KB5129955 to KB5129958, not against the 13 October updates, so confirm both sets are installed. Microsoft rates both CVE-2026-96940 and the critical entry as “Exploitation More Likely”..
  • SQL Server has 22 CVEs, none of them critical: eight remote code execution, seven elevation of privilege, four information disclosure and three denials of service. Each supported branch gets a cumulative update and a GDR: 2025 (KB5126967, KB5128492), 2022 (KB5126934, KB5128493), 2019 (KB5128494, KB5128495) and 2017 (KB5128496, KB5128497).

Exchange goes on the Patch Now list. SQL Server goes on the Schedule list because none of its 22 entries is critical. If September’s SQL Server update is still outstanding, install it first.

Microsoft Developer Tools

Microsoft released 66 CVEs across its developer tooling this month: two critical, 63 important and one moderate. Remote code execution accounts for 18 entries and elevation of privilege for 13.

  • Both critical entries also affect Windows. CVE-2026-105016 is a remote code execution flaw in Microsoft QUIC that needs no authentication or user interaction, and it affects .NET 8, 9, 10 and 11 on Windows and Visual Studio 2022 and 2026. CVE-2026-96222 is an AD FS certificate validation flaw that Microsoft lists against both the .NET Framework and Windows Server.
  • Two entries were publicly disclosed before release. CVE-2026-108398 in the .NET Framework lets an authenticated attacker bypass Windows Defender Application Control. CVE-2026-92707, a denial-of-service vulnerability in the MessagePack-CSharp library assigned by GitHub, affects Visual Studio and the ASP.NET Core SignalR MessagePack protocol.
  • Visual Studio Code has 10 fixes, five of them security feature bypasses, and PowerShell 7.4, 7.5 and 7.6 take two.

Add these updates to your Patch Now schedule, starting with the .NET updates that carry the QUIC fix.

Adobe (and third-party updates)

Adobe published 11 security bulletins on 13 October, covering 175 CVEs across ColdFusion, Experience Manager, Commerce, Photoshop, Bridge, FrameMaker, Dimension, the Substance 3D tools and the Content Credentials SDK. None is rated priority 1, and Adobe is not aware of exploits for any of them. No Acrobat or Reader security update for this month. I mentioned last month that we are in for a few months of extraordinary patch releases. Harking back to 2003 (when I started work on the nascent field of Microsoft patch management), with Microsoft releasing just  51 updates, anything over a 1000, much less 1400 CVE entries would have been unimaginable. I don’t think that we are at a “patch maximum” yet — but I hope that things calm down soon.

MacVoices #26270: Live! – Apple’s AI Photo Editing, Rosetta’s End, Apple Watch Pairing

By: Chuck
2 October 2026 at 20:24
Whether Apple Watch can pair with multiple iPhones, the storage demands of Apple Intelligence, and preparing Macs for the end of Rosetta support kick off this discussion. Other topics include whether expensive phones need cases, AI photo editing versus Photoshop, Pixelmator Pro as an Adobe alternative, and what Adobe’s acquisition of Topaz Labs means for  users. 

💾

September Patch Tuesday: 963 CVEs, 2 exploited flaws, 1 message

14 September 2026 at 14:10

Microsoft’s September 2026 Patch Tuesday is the year’s largest release, with 963 CVEs requiring customer action, 106 rated critical. Two are already exploited: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Advanced Local Procedure Call. Nothing in this release was publicly disclosed ahead of the patch. Readiness recommends a Patch Now scheduling for Windows, Office, SQL Server and the developer tooling, and standard patch release for Exchange. The Readiness team has published an infographic summarising deployment risk by product family.

Known issues

Three client issues are carried in from August close with this update, covering:

  • Microsoft Teams and the new Outlook failing to launch on ARM devices, such as the Surface Pro 11 and Surface Laptop 7, is resolved by KB5124008. The issue originated in August’s KB5121003 and was most likely on freshly imaged machines that had not yet taken Microsoft Store updates.
  • The same update resolved both desktop backgrounds reverting to solid black and mouse cursor customisation resetting on non-English installations. Both originated in the 27 August preview, KB5120998.

And Microsoft has left open a Microsoft Defender Antivirus notification defect, confirmed on 28 August, in which devices report that Defender is turned off while it is running correctly.

Major revisions and mitigations

The quietest revision window of recent months arrived alongside the largest release. Between the August and September Patch Tuesdays, from 12 August to 7 September, the MSRC Security Update Guide touched 324 CVEs. Of those, 307 were routine Microsoft Edge and Chromium republications requiring no customer action.

That leaves 17 entries affecting Microsoft’s own products, and only one of those is a genuine revision. CVE-2026-59133, an elevation of privilege in the High-Performance Computing Pack, moved to version 1.1, and its own revision note records the change as informational. For comparison, August’s window carried 76 revisions to Microsoft’s own products, 60 of them flagged as requiring customer action.

The Readiness team has reviewed all 963 published updates. Microsoft has published no mitigations and no workarounds anywhere in this release.

Windows lifecycle and enforcement updates

Microsoft has published no new service or enforcement deadlines for September. The lifecycle picture is different, with multiple end-of-support notices for this coming October:

  • The retail Office 2021 family retires in full, including Access, Excel, Outlook, PowerPoint, Project, Publisher, Visio and Word.
  • Office LTSC 2021 reaches end of support, and that includes Skype for Business LTSC 2021.
  • Windows 10 2016 LTSB and Windows 10 IoT Enterprise LTSB 2016 reach the end of extended support.
  • Windows Server 2012 and 2012 R2 reach the end of Extended Security Update Year 3. This is the final ESU year for both, not a step to a fourth.
  • Windows 11 Home and Pro version 24H2 reaches the end of updates.
  • Windows Server 2022 moves from mainstream to extended support, where it stays until 14 October 2031.

A second wave follows on 10 November 2026, and it is the one most likely to catch development teams rather than infrastructure teams. .NET 8 reaches the end of its long-term support branch, PowerShell 7.4 does the same, and Windows 11 Enterprise and Education 23H2 ends servicing alongside Windows 11 IoT Enterprise 23H2.

Microsoft’s test guidance for this release runs to 466 Windows entries, 55 of them flagged as high risk, against 109 and four in August. Given the large number of updates this month (who would have thought that we would be here at 963 CVEs), the Readiness team recommends the following testing priorities:

  • Printing. Print from 32-bit and 64-bit applications to physical and virtual printers, exercise XPS and PDF output, share a printer from a print server and print from a separate client, cancel a job mid-queue, and confirm the queue reflects every state change. This is 20 of the 55 high risk flags, and it is the single most likely source of a visible regression.
  • Fonts, graphics and imaging. Render varied fonts, sizes and styles across browsers, Office, PDF viewers and Notepad, confirm Print Preview matches the printed page, and open JPEG, TIFF, HEIF and raw images across Explorer, Photos and Office. Watch for clipping, distortion and missing glyphs.
  • USB Devices. Exercise device attachment and removal. Attach and remove USB audio, video and mass storage devices repeatedly, including through a hub, pair and unpair a wireless device, and confirm each enumerates and releases cleanly. Device Association carries seven high risk flags, and these drivers load whenever hardware is attached.
  • Remote Desktop. Open several concurrent sessions, enable printer, clipboard, audio, drive and smart card redirection together, disconnect and reconnect, and confirm redirected devices reattach.
  • Storage (ntfs.sys, spaceport.sys). This is a real hotspot for updates this month, but no high-risk changes. Test on hardware you can recover, because the storage changes reach the boot path, potentially resulting in a dead (test) machine.

Each month, we break down the update cycle into product families, as defined by Microsoft, with the following groupings.

Browsers

Microsoft has not released any updates for their browser products for the second month in a row. September’s Security Update Guide carries no Edge-specific CVEs at all, and the 307 Chromium republications in the revision window required no customer action. The nine Edge CVEs that did appear arrived mid-cycle on 28 August and were serviced through the browser’s own update channel rather than this release.

Estates on a managed Edge channel have nothing to do here beyond confirming the channel is current. It is the one quiet corner of an otherwise heavy month.

Microsoft Windows

Windows carries 726 CVEs, 77 of them critical, which is three-quarters of the entire release. Elevation of privilege dominates by volume at 406 entries, with remote code execution second at 156, information disclosure at 94 and denial of service at 47. The pattern is the reverse of the severity picture: the bulk is local elevation, while the critical-rated entries cluster in the network-facing roles.

  • Biometrics is a real focus this month as the Windows Biometric Service takes 64 fixes, the largest single-component count of the year. Most of the security issues are heap overflows that give a local attacker SYSTEM. Windows Hello adds nine, all critical. Patch it promptly on any estate using fingerprint or facial sign-in.
  • Windows DHCP Server leads at 36 entries and is topped by remote code execution at CVSS 9.8. Windows DNS Server takes 10 more, also reaching 9.8. Critical remote code execution also lands on Message Queuing, RRAS, Services for NFS, the HTTP Print Provider, Windows Shell, Netlogon, Internet Connection Sharing, SSTP and Failover Cluster, all at 9.8. Patch the resolvers, the DHCP servers and the domain controllers first.
  • Storage is the heaviest it has been this year. NTFS takes 29 fixes, Spaceport.sys behind Storage Spaces takes 17, and the Overlay Filter takes seven, with the Volume Manager, VHD miniport, iSCSI and Storage Port drivers behind them. These reach the boot path, so stage them on recoverable hardware.
  • The rest of the most-patched tally runs Win32k at 19, Microsoft Standard XPS at 18, Windows Error Reporting at 12, and the Windows Kernel, Windows Search, the Print Spooler and the Device Association Service at 11 each.

Add this Windows update to your Patch Now schedule, with DHCP and DNS servers first and the biometric stack close behind.

Microsoft Office

Microsoft released 137 Office CVEs this month, 24 of them critical, with remote code execution the through-line at 69 entries and information disclosure close behind at 52. September breaks the recent pattern in a way that matters for deployment: this wave is not MSI-only.

  • Click-to-Run estates are squarely in scope. Roughly 105 of the Office CVEs reach Click-to-Run, so Microsoft 365 Apps, Office 2019, LTSC 2021 and LTSC 2024 all update, on Windows and on Mac. Word takes 35 fixes, Excel 32, PowerPoint 10 and Outlook seven. The heaviest client entries are CVE-2026-78510 in Word and CVE-2026-78509 in Outlook, both critical remote code execution at CVSS 9.8, in document-rendering paths that fire on preview or open.
  • SharePoint Server Subscription Edition takes 16 entries and is the only SharePoint baseline with a package this month. Server updates cannot be uninstalled and always require a reboot, so validate in a maintenance window.
  • Skype for Business Server takes 10 entries, led by CVE-2026-66302, a critical remote code execution at CVSS 9.8. Patch it and note that the LTSC 2021 edition leaves support on 13 October 2026.

Nothing in Office is exploited this month. With 24 critical-rated entries and the Click-to-Run channel carrying most of the exposure, the September Office updates belong on the Patch Now schedule regardless.

Microsoft Exchange and SQL Server

Exchange is quiet and SQL Server is not, which inverts the usual relationship between the two.

  • Exchange Server takes nine CVEs across 2016 CU23, 2019 CU14 and CU15, and Subscription Edition. None is critical and none is exploited, though the highest reaches CVSS 9.3. The mix runs to two remote code execution entries, two elevations of privilege, two spoofing, and one each of tampering, denial of service and information disclosure. Apply the update from an elevated command prompt, because an un-elevated run leaves Exchange services partially patched and broken, then confirm mail flow, Autodiscover and any hybrid connection before returning the server to service.
  • SQL Server takes 62 CVEs, four of them critical, across the 2017, 2019, 2022 and 2025 branches. There is no 2016 package this month. Remote code execution leads at 24 entries, with information disclosure at 22. The critical entries are CVE-2026-67631 and CVE-2026-67643 at CVSS 8.8, and CVE-2026-67378 and CVE-2026-67636 at 8.5.
  • Eight SQL packages ship, a CU+GDR and an RTM+GDR for each branch: 2025 (KB5122769, KB5122770), 2022 (KB5122768, KB5122771), 2019 (KB5122772, KB5122773) and 2017 (KB5122774, KB5122775). Microsoft’s guidance is explicit that the baseline or RTM version must be installed first and the GDR patch applied on top; test the install and the removal on every servicing branch you run, then restart the service and confirm Always On availability groups stay healthy.

Exchange goes on the Schedule list, and SQL Server goes on the Patch Now list. That is an unusual split, and it is driven by the four critical remote code execution entries on the database estate.

Microsoft Developer Tools

Microsoft released 24 CVEs across its developer tooling this month, 23 rated important and one critical. Security feature bypasses are the main focus with eight CVE entries, with remote code execution and information disclosure at four each.

  • The single critical entry is CVE-2026-34182 at CVSS 9.1, a flaw in CMS AuthEnvelopedData processing that allows forged messages to be accepted. It reaches Visual Studio 2017 through 2022.
  • The highest-scoring entry in this family is not the critical one. CVE-2026-81376, a Visual Studio Code security feature bypass, reaches CVSS 9.6 while carrying an important rating. It is a useful reminder that severity labels and CVSS scores answer different questions.
  • Visual Studio Code and its Copilot extensions take 10 entries, mostly security feature bypasses. Update the editor and confirm workspace trust prompts, extension installation and remote sessions behave as configured.
  • .NET ships SDK updates on all three supported lines, x64 and x86: 8.0.131 and 8.0.425, 9.0.121 and 9.0.318, and 10.0.112 and 10.0.401. Install them, then build and run a representative project to check for regressions. Keep the 10 November date for .NET 8 in view while you are in there.
  • The .NET Framework ships monthly rollups per operating system: Windows Server 2012 (KB5126147), Server 2012 R2 (KB5126148), Windows 10 1809 (KB5126144), 21H2 (KB5126145), 22H2 (KB5126146) and Server 2022 (KB5126149). One gap worth noting: the 4.7.2 package for Windows 10 1607 is listed as pending and will follow, so estates still on 1607 will not complete their Framework patching this cycle.

Add these to your standard release schedule, behind this month’s Windows, Office and SQL Server priorities. Keep the 10 November date for .NET 8 and PowerShell 7.4 in view while you are in the developer estate, because a patch this month does not extend either branch.

Adobe (and third-party updates)

September is the largest release of the year, and this (crazy, super high) volume is the least interesting thing about it. The 963 CVEs matter less than the 55 entries Microsoft flags as high risk, and those sit in printing and fonts. Adobe shipped two Acrobat builds one digit apart and only the second is a security update (nothing to worry about here). Of the CVEs Microsoft republished, 25 are not Microsoft’s. A version number tells you very little about the work in front of you. So, given my (super-secret knowledge) of how Microsoft operates over the summer, here is my prediction for next month (October). It won’t be as big as this month – but just you wait – November is going to be big. Let’s up those numbers (or not).

Adobe Acrobat evolves beyond PDFs with enterprise search, AI content creation

9 September 2026 at 19:23

Adobe on Wednesday unveiled a range of updates to Acrobat, including the ability to turn PDF documents into interactive visual reports and podcasts. And a new Knowledge Base feature connects Adobe’s Acrobat AI assistant to document sources such as Microsoft SharePoint and Google Drive.

It’s the biggest Acrobat update in several years, Adobe said, and highlights the application’s evolution from PDF reader to what the company now describes as an AI-powered document productivity and creativity platform. 

Acrobat users open more than 400 billion PDFs in the app each year, Adobe said, claiming 650 million monthly active users as of last year. 

Among the new additions is the ability to turn dense PDFs into interactive, visual documents and presentation slides. To create these, Acrobat’s AI assistant scans the selected file, asks questions about the user’s intent, then generates documents charts, images and navigation.

It’s also possible to turn documents and web links into podcast-style audio summaries — similar to capabilities in Google’s NotebookLLM and Microsoft Copilot Notebook. A new Stylize feature can enhance plain-looking documents, applying a template to turn them into “professional deliverables” such as CVs and invoices, Adobe said.

The audio and visual generation features are all available in paid Acrobat plans (Acrobat Studio, Acrobat Express and Acrobat AI Assistant). 

Another addition, Acrobat Knowledge Base, lets customers connect the Acrobat AI assistant to a wider range of file types, enabling users to ask questions about information held in documents stored in Microsoft SharePoint and Google Drive, for example.  

Acrobat’s Knowledge Base “transforms curated document collections — policies, playbooks, product information, pricing guidance, research — into cited answers available from Slack, Microsoft Teams, Acrobat, and other places employees already work,” Abhigyan Modi, senior vice president for Adobe Document Cloud, said in a blog post. 

Adobe also added an Analyzer tool designed to retrieve data from large volumes of documents. This could involve analyzing thousands of contracts or invoices to identify information such as renewal dates and revenue clauses.

That turns information once trapped in files into data that can inform finance, procurement, compliance, and the systems that support them, said Modi.

Analyzer is the more interesting of the two releases, said Mike Leone, vice president and principal analyst at Moor Insights & Strategy. “Knowledge Base is a search product and search products get judged feature against feature. Analyzer is closer to a data product, because that extraction work is what companies currently pay people and pipelines to do,” he said. 

“What I’d want Adobe to answer is whether that data can leave Acrobat and land where the rest of the company’s data lives. If it can, this starts competing for real data budget. If it stays inside the app, it’s a very good Acrobat feature.” 

Access to Analyzer and Knowledge Base requires an Acrobat Studio for Enterprise subscription. (Adobe doesn’t publish pricing.) 

In addition, Knowledge Base includes a credit-based model that places some restrictions on usage, with licensed users allowed up to 1,000 queries a month. Other actions, such as document uploads, queries from Slack and Microsoft Teams, and queries by employees without an Acrobat Studio license, draw varying amounts of Acrobat Studio “shared credits.” Adobe didn’t say how much additional credits cost once a yearly limit is reached.

 More information about Adobe’s Knowledge Base credit usage policy is available on Adobe’s website. 

Analyzer also includes a credit system that limits document ingestion and attribute extraction.

For enterprise customers, usage-based pricing can add complexity when managing employee access.

“The issue for a broad deployment is that headcount barely predicts usage,” said Leone. “One person pointing it at 10,000 contracts will burn more credits than a hundred people asking the occasional question. Pooling the credits across the whole organization is the right design, because usage on something like this is rarely spread evenly.

“One of the big challenges is that people could very well start rationing themselves because they don’t know what a question costs,” he said. “Or worse, a couple folks use all the credits and everyone else is out of luck. The last thing any organization wants is to pay for a knowledge tool that people won’t use or can’t use.”

Adobe Premiere e After Effects ganham novos recursos de IA

9 September 2026 at 16:00

A Adobe anunciou uma nova leva de recursos de inteligência artificial (IA) que estão chegando ao Premiere e ao After Effects, incluindo a nova Generative Media Tool.

A nova ferramenta permite gerar vídeos e efeitos sonoros a partir da própria linha do tempo, dentro do Premiere.

Para utilizar a Generative Media Tool, basta selecionar o trecho da linha do tempo em que você deseja criar, descrever aquilo que deverá ser gerado, escolher um dos modelos de IA suportados pela ferramenta (Adobe Firefly, Google Veo, Runway, Luma ou Kling) e pronto, o conteúdo gerado já estará presente no seu projeto.

Adobe Generative Media Tool no Premiere
Divulgação/Adobe

Os materiais feitos por IA são adicionados como clipes editáveis, permitindo que o usuário os manipule como quiser. Além disso, caso seja da sua preferência, a ferramenta possui a capacidade de utilizar quadros de vídeos já existentes como referência para aquilo que será gerado, tornando o recurso ideal para estender determinadas cenas.

Já em matéria de áudio, o Premiere possui agora ferramentas (implementadas em fase beta) para tratamento e separação de vozes em falas simultâneas.

Novos recursos de áudio no Adobe Premiere
Divulgação/Adobe

A Adobe também atualizou o Color Mode, destinado a correções de cor realizadas dentro do Premiere, oferecendo tanto visuais cinematográficos com os novos Style Modules (com os modos Vignette e Midtones) quanto a Auto Color Tool, que corrige automaticamente a exposição e a temperatura de um clipe ou uma sequência.

Por fim, a empresa também anunciou a chegada do seu assistente de IA para os usuários do After Effects (em versão beta), permitindo tanto a novos usuários da ferramenta quanto aos editores mais experientes manipular projetos e criar efeitos a partir de comandos em linguagem natural.

Todas essas novidades já estão disponíveis para os assinantes da suíte Adobe Creative Cloud.

“We Couldn’t Believe What We Were Seeing”: Scientists Have Discovered a Bizarre New Microbe with an “Alien” Reproductive Strategy

8 September 2026 at 13:33

A recent study published in Protist reports that a marine microorganism reproduces in a previously unknown way: by creating new cells inside its body, then rupturing to release them.

The bizarre process is reminiscent of the reproductive horror depicted in the movie Alien, albeit on a microscopic scale.

This microbe is part of the Labyrinthulomycetes, a group of marine microorganisms that play a key role in recycling nutrients by breaking down dead plants and animals in salty environments. Beyond their ecological importance, some species in this group are valued for producing omega-3 fatty acids like DHA, which is also found in oily fish, and carotenoids, pigments used in food coloring.

This newly discovered species also contains roughly 50% protein, adding to its potential commercial value for applications such as food supplements, infant formula, and aquaculture.

An “Alien” Reproductive Strategy

“Instead of dividing into two, as we would expect, the mature cells develop a large internal chamber in which entirely new daughter cells grow,” said Professor Peter Morris, a plant biologist at Heriot-Watt University.

“Some of those daughters already have another developing generation inside them, before they are released when the mother cell breaks open,” Morris added. “So, these microbes can be pregnant grandmothers, in the same way as some species of greenfly are born already pregnant.”

The researchers named the new species Caledochytrium aldermanii, drawing from Caledonia, the Latin name for Scotland, where it was discovered in three locations. The species name also recognizes Dr. David Alderman, whose early work culturing the microbe made the study possible.

This discovery resulted from a long-term collaboration among Heriot-Watt University, its spinout company Strameno, CEFAS Weymouth, and the Institute of Aquaculture at Stirling University.

Caught by Watching, Not Just Sequencing

Dr. Jane Polglase, who has spent nearly five decades studying Labyrinthulomycetes and co-founded Strameno with Alderman and Dr. Lydia Brown, helped document the microbe’s unusual reproduction. The team relied on traditional observation and description, an approach less common in today’s genomics-focused research.

“While lots of scientists now focus on the DNA of any creature, we’ve taken an old-fashioned approach, also observing the microbe’s behavior and describing its morphology fully,” Polglase said. “If we had not done that, we never would have captured this peculiar reproductive process on camera.” When the team finally caught it under an electron microscope, she said, “We couldn’t believe what we were seeing.”

Resourceful Marine Recyclers

Researchers found Caledochytrium in a variety of habitats, including octopus dens, on rainbow trout, and in a salt marsh along Scotland’s east coast. The researchers believe it contributes to nutrient recycling by breaking down animal and plant material.

An important part of this recycling process is the ectoplasmic net, a network of membranes the microbe creates to move around, feed, and stay buoyant. When it moves to a new surface, the microbe leaves the net behind, where marine larvae can feed on the leftover material, helping pass protein and lipids up the food chain.

What Comes Next

“Understanding how this species reproduces is key to understanding how it could be used in commercial settings, like aquaculture,” Morris said.

With this phase of research complete, the Heriot-Watt and Strameno team hopes others will continue the work. The discovery highlights how much remains to be learned about the diversity and behavior of life in the oceans.

Austin Burgess is a writer and researcher with a background in sales, marketing, and data analytics. He holds an MBA, a Bachelor of Science in Business Administration, and a data analytics certification. His work focuses on breaking scientific developments, with an emphasis on emerging biology, cognitive neuroscience, and archaeological discoveries.

Adobe replaces CEO with customer experience leader

4 September 2026 at 11:19

Adobe’s search for a new CEO is over: It has promoted Anil Chakravarthy, president of its customer experience orchestration business, to the top role.

It has taken six months to find a successor to outgoing CEO Shantanu Narayen, who announced in March that he would step back from the CEO role, remaining with the company as chairman.

There had been much speculation that he would be replaced by Adobe’s president of creativity and productivity, David Wadhwani, who was responsible for the digital media business segment that generates around three-quarters of the company’s revenue. Having missed out on the top job, however, he has chosen to leave Adobe, announcing his departure on LinkedIn.

Chakravarthy was responsible for the development of several products, including Adobe CX Enterprise, GenStudio and Brand Visibility, as well as the introduction of CX Enterprise Coworker.

He takes over at a shaky time for Adobe: Its stock price has tumbled dramatically in the past few years as the rise of AI has meant workers can lay out content and manipulate photos without needing Adobe products. Chakravarthy, who will initially work in tandem with Narayen, will have his work cut out for arresting the current decline.

MacVoices #26142: NAB – Mapcreator Makes Maps Fast, Animated, and Newsroom-Friendly

By: Chuck
12 May 2026 at 22:05
In the Mapcreator booth at NAB in Las Vegas, Julia Schellekens provides an update on their service that delivers detailed maps for news and other organizations who want to clearly show what is happening where. With a wide array of export and animation capabilities to help drive home the information, it is almost certain that you have seen their product in use no matter where in the world you are. 

💾

Adobe Combines Photoshop, Premiere, And More In New ChatGPT Plugin

6 August 2026 at 16:02

Adobe is making it much easier for creators to build things by putting its best software straight into ChatGPT. The company just released a massive new plugin that combines over 70 features from popular apps like Photoshop, Premiere, Firefly, and Acrobat into one single spot. With this new setup, you can ask the chatbot to […]

The post Adobe Combines Photoshop, Premiere, And More In New ChatGPT Plugin appeared first on The Mac Observer.

Acorn 8.6

30 July 2026 at 20:21

Gus Mueller (release notes):

  • A new brushing engine that has been rewritten using Metal shaders. It includes an option for “velocity thinning”, where the faster you draw your brush strokes, the thinner the lines.
  • A new acorn shell tool that you can use to send JavaScript to Acorn, as well as start an MCP server. So if you’ve got a favorite LLM you like to use, you can now use it to drive Acorn. The JavaScript section of the release notes are a good read if you’re interested in that. In addition:
    • The JS API has also been updated with examples for most calls.
    • The shell tool has a -jsio argument which lets you do things like:
      echo "acorn.takeLayeredScreenshot();" | acorn -jsio
  • Big ML models (used for Select Subject and Super Resolution Scaling) are now downloaded on demand. If AI isn’t your thing, they won’t take up any space on your Mac.

I feel lucky that Acorn is enough for me.

Chris Person:

Very few software companies outside of Microsoft have the kind of leverage over entire industries. Premiere, Photoshop, Illustrator, InDesign, Lightroom and After Effects are all load bearing to some extent within their respective fields despite the fact that many people I know loathe using them.

Via Nick Heer:

I have said it before and I will say it again: if I had known the path Adobe’s software would eventually go down, I might very well have picked a different career.

Previously:

Photoshop and Premiere now have AI assistants

18 June 2026 at 14:00
The new AI assistant in Adobe Photoshop.
Photoshop is one of several Adobe Creative Cloud apps to receive new conversational editing capabilities. | Image: Adobe

Adobe's plan to stick AI assistants into all of its Creative Cloud suite is now fully underway, with new chatbots now rolling out to its biggest editing and design apps. As part of a public beta launching today, Photoshop, Premiere, Illustrator, InDesign, and Frame.io now each have a bespoke AI Assistant that can be used to organize your work and automate app-specific tasks.

While the AI assistants are all powered by Adobe's "conversational creative agent," they work independently and operate "as a specialist" within each Creative Cloud app, according to Adobe's announcement. That means the Premiere AI assistant is fine-tuned for tasks like …

Read the full story at The Verge.

Adobe’s redesigned AI studio remembers what your creations look like

18 June 2026 at 14:00
The new Elements feature for Adobe’s Firefly AI studio.
Give your characters, objects, and backgrounds a name to easily replicate them without changing the design. | Image: Adobe

Adobe is introducing some new capabilities for its Firefly AI assistant, alongside a "reimagined" AI studio that lets you edit and generate new designs from a single interface. The new Firefly experience launching today in private beta is designed to give you "persistent context, reusable assets, and organized workflows" across your projects, according to Adobe, making it easier to go from ideation to production-ready designs without switching between apps.

This is the latest of several design overhauls to Adobe's all-in-one Firefly AI hub since it was first launched in September 2023. In addition to the UI updates, the new Firefly AI studi …

Read the full story at The Verge.

Adobe: New Firefly Graph can turn creative workflows into reusable assets

17 June 2026 at 19:32

Adobe’s Firefly Graph is now available to Creative Cloud customers, offering a node-based workflow tool designed to help business create content at scale with generative AI (genAI). 

With Firefly Graph, users can connect multiple tools in visual workflow, with each “node” performing a specific task before passing its output to the next node. This gives creative professionals more control over generated outputs, according to Adobe, and makes it easier to try out ideas by swapping, adjusting or adding components.

For example, a user could start with a text prompt box that connects to a node that generates an image using an AI model from Adobe or third-parties such as Google and OpenAI. Further along the chain, the user could add nodes to remove a background or upscale an image, for instance, before producing an image, video or other asset ready for use.

Changing one aspect, such as adding a reference image or adapting the text prompt, would change the final output.

It’s an approach similar to node-based workflow tools such as ComfyUI — a startup valued at $500 million which claims more than 4 million users. Others include Weavy, acquired by Figma last year for a reported $200 million. 

With so many AI tools available to creative professionals, workflows can get complex and hard to replicate, said Elliot Sedegah, director for strategy and product marketing at Adobe. Firefly Graph provides access to more than 300 different node types, including images, video editing and AI generation tools across Adobe’s portfolio and third-party tools. 

“Whether you’re working at a mom-and-pop shop or a larger enterprise, you’re looking for consistency and then bringing that into a workflow so that you’re not hopping in and out of different tools,” he said. “Putting all that together takes massive amount of time, and sometimes it’s very difficult to even know what you did.”

Once created, workflows can be shared across an organization as repeatable processes for other individuals or teams to use. “Think of that rock star creative that you have and the recipes they create: those are now canonized as workflows, as assets, that the rest of the organization can take and reuse over and over again,” said Sedegah.

In addition, while creative professionals are needed to created high quality assets, reusable workflows can be put into the hands of broader teams to create content for large audiences, said Sedegah.

Firefly Graph addresses a challenge that most large creative organizations face, said Lisa Gately, principal analyst at Forrester — namely that their best creative workflows “live inside the heads of a few experts.

“Teams can generate images and video with AI, but reproducing the exact sequences of creative decisions, model selections, edits, and refinements that lead to a high-quality result is difficult and inconsistent. Firefly Graph turns those workflows into reusable assets,” she said.

While other node-based workflows aim to address similar problems, Adobe’s pitch is that Firefly Graph provides customers with the benefit of integration into its product suite. 

“Firefly is a full, broader AI creative studio, not just a node-based tool, so [Firefly Graph] is a part of a bigger picture,” said Sedegah. “The strength is having everything in one place with the tools that people know.” 

“Where Adobe differentiates is in enterprise integration,” said Gately, with Adobe connecting Firefly Graph to a range of other Adobe tools. Those include Creative Cloud applications; Firefly Boards for ideation; and Firefly Creative Production. 

“The workflow becomes part of a broader content supply chain instead of a standalone creation tool,” she said. ”Organizations committed to other tools are unlikely to migrate for a node-based canvas — making a change is about the broader content supply chain.”

Firefly Graph is available now to Adobe Creative Cloud for Enterprise subscribers. Creative Cloud for Enterprise is licensed by seat, requiring custom, volume-based enterprise agreements. Creative Cloud for Enterprise customers receive credits for Firefly Graph. Creative Cloud for teams customers can sign up for a public beta online. Creative Cloud pricing starts at $99.99 per license each month.

This article was updated on June 19 with pricing information from Adobe.

❌