Connect with us

NEWS

CSIRTs Inherit Europe’s Missing security.txt Before Article 14

76 percent of reachable European software vendors lack security.txt, so CSIRTs will catch researcher reports when the CRA 24-hour clock starts.

Published

on

European software vendors missing security.txt before CRA reporting

A 14 August scan of European software vendors found 374 of 492 reachable sites had no security.txt file. That is 76% of the live sample, two weeks before the EU’s 24-hour vulnerability clock starts.

The file is how a researcher is supposed to find a private inbox. When it is missing, the report tends to land on a national CSIRT desk, a public post, or a customer thread, and that is still awareness under the Cyber Resilience Act.

374 Reachable Vendors Still Have No Inbox

CRA Incident Drill, an independent research project, requested /.well-known/security.txt on 623 domains taken from the europealternatives.com directory of European SaaS and software companies. The check was a single GET, up to three redirects, with an eight-second timeout, on 14 August 2026.

A file counted as present only on HTTP 200 with a Contact line, which dropped SPA catch-alls that return 200 for every path. Unreachable names were left out of the percentages.

Measure Count
Domains scanned 623
Reachable over HTTPS 492
Valid security.txt (HTTP 200 and Contact) 118 (24%)
No standard file 374 (76%)
Unreachable (excluded from the rates) 131

The authors publish aggregates, not the vendor list, because naming the dark domains would help attackers first. They also note that some firms take reports through bug-bounty platforms or a published security mailbox. The scan measures RFC 9116 adoption, not every possible inbox.

Article 14 Starts 15 Months Before a Contact Address

From 11 September 2026, makers of products with digital elements sold in the EU must report actively exploited flaws and severe incidents. The Commission’s CRA reporting page says they file an early warning within 24 hours of becoming aware, a fuller notice within 72 hours, and a final report later.

That duty is the first slice of Regulation (EU) 2024/2847 to apply. The Act entered into force on 10 December 2024. Most other rules, including Annex I’s essential cybersecurity requirements, apply from 11 December 2027.

Annex I Part II tells makers to enforce a coordinated disclosure policy and to provide a contact address for reports. That contact duty is 15 months after the 24-hour clock. Until then, the standard doorbell is still optional, while the legal timer is not.

When security vulnerabilities are discovered by researchers, proper reporting channels are often lacking. As a result, vulnerabilities may be left unreported.

RFC 9116, A File Format to Aid in Security Vulnerability Disclosure, IETF

Edwin Foudil and Yakov Shafranovich published that diagnosis in April 2022. The Commission’s own CRA summary adds that reporting covers products already on the Union market, including those placed there before 11 December 2027, which matches the Article 69(3) carve-out the scan cites.

THE REPORTING CALENDAR

  1. April 2022: RFC 9116 defines security.txt as a known-location contact file.
  2. 10 December 2024: The Cyber Resilience Act enters into force.
  3. 11 June 2026: Chapter IV rules on notifying conformity assessment bodies apply.
  4. 11 September 2026: Article 14’s 24-hour, 72-hour and final-report duties apply.
  5. 11 December 2027: Annex I’s disclosure policy and contact-address duties apply with the rest of the product rules.

Awareness, not the birth of the flaw, starts the timer. A researcher who cannot find a private channel still creates that awareness when the note reaches a CERT, a journalist, or a customer.

Mail for 374 Vendors Lands on CSIRT Desks

National Computer Security Incident Response Teams already sit in the middle of this traffic. Under NIS2, member states must let people report flaws to a designated CSIRT, which then finds the vendor, helps the reporter, and negotiates disclosure when several parties are hit.

Article 14 now sends manufacturer filings to the same desks. A maker reports once through ENISA’s Single Reporting Platform. The notice goes to the CSIRT of the member state of the maker’s main establishment and, except in rare cases, to ENISA at the same time. That first CSIRT then shares the file with CSIRTs in other states where the product is sold.

ENISA’s August FAQ already tries to spare those teams extra work. Makers should register on the platform when they have a notice to file, it says, so CSIRTs are not asked to validate idle accounts. The same FAQ says CSIRT validation of a company’s representative happens after first access, in parallel with reporting, and should not block a filing.

The scan’s 374 silent vendors do not wait for that form. A researcher who cannot find Contact: still writes a national CSIRT because that is the path NIS2 already advertised. After 11 September the CSIRT may be both the first reader of the bug and the legal inbox for the company’s 24-hour warning.

Open-source stewards sit in a thinner version of the same duty, to the extent they are involved in products with digital elements. Voluntary reports of flaws, threats, incidents and near misses are due to open on the platform after the same date, which gives researchers a third door when the vendor has none.

Germany’s BSI Found the File on 1.8 Percent

Among European SaaS names the 24% hit rate looks poor as a CRA headline. Against the open web it is a high-water mark, and the CSIRT problem is still the 374 domains that sit below it.

Population security.txt rate Who measured it
European SaaS, reachable HTTPS 24% CRA Incident Drill, 14 August 2026
German websites 1.8% BSI, 6 August 2026
Desktop websites in the HTTP Archive crawl 1.82% 2025 Web Almanac

On 6 August Germany’s Federal Office for Information Security said only 1.8 percent of German website operators publish the file, in measurements for its Cyberdome project. The agency told operators the effort is small and pointed to the 11 September reporting duties. The 2025 Web Almanac, using HTTP Archive data, put adoption at 1.82 percent of desktop websites and 1.72 percent of mobile sites, up from 1 percent in 2024.

About a quarter of those published files still fail a full RFC check because they omit a valid Expires date. Contact itself is almost universal when a file exists. The gap is getting the file onto the host, then watching the mailbox it names.

What a Researcher Does When Nobody Answers

RFC 9116 defines a machine-parsable vulnerability disclosure format at a single well-known path. The Contact field must always be present and must use a URI, such as mailto:security@example.com or an https form. Encryption keys belong at a URI, not pasted into the file. A policy field can point at the actual disclosure rules, which are a separate document from the doorbell.

A watched file is still a process. A published Contact that nobody reads is a decoy, and that is already how some long vendor chases go: a first note to the listed mailbox, a second from a corporate address, a LinkedIn ping to a CISO, then a national CERT, then a coordinator listing the vendor’s status as unknown months later.

THE USUAL ESCALATION

  • First lookup: GET https://domain/.well-known/security.txt and use the Contact URI if it is there.
  • Fallback hunt: security@, a /security page, or a bug-bounty form, which the scan does not count.
  • Personal chase: a named security lead on LinkedIn when the mailbox is silent.
  • Coordinator: a national CSIRT or CERT/CC, which is the NIS2 path and, after 11 September, a likely start of awareness.
  • Voluntary SRP: a report of a flaw, threat, incident or near miss through ENISA’s platform once that door opens.

Each extra hop burns calendar time the 24-hour rule does not give back. If a CSIRT notice or a public write-up is the first thing the vendor cannot deny seeing, the early warning is already late, and it is already public.

ENISA Is Still Testing the Reporting Platform

Article 16 told ENISA to build a single electronic entry point so a maker files once. The Commission’s 23 August reporting page says functional and security testing are under way, and that the Single Reporting Platform will be live by 11 September 2026. ENISA’s FAQ, updated 3 August, says the same go-live and that a testing period is expected first.

WHAT WE KNOW

  • Go-live: ENISA says the platform is scheduled to be operational by 11 September 2026, the day Article 14 applies.
  • Login: company representatives will use an EU Login account; CSIRTs validate who may file for a given maker after first access.
  • No API yet: large filers may script their own workflows, but ENISA will not offer application programming interfaces at this stage.
  • Help desk: cra-srp-helpdesk@enisa.europa.eu is the contact published for questions the FAQ does not cover.

WHAT IS UNCONFIRMED

  • Public URL: ENISA said the dedicated address would be posted on its SRP page before launch; that URL was not on the 3 August FAQ.
  • Day-one load: whether CSIRT validation queues stay out of the way when many first filings arrive together is still an operational question.

A delayed-dissemination delegated act from December 2025 lets a CSIRT hold back sharing with other teams on cybersecurity grounds. That is a sharing brake, not a filing brake. ENISA also says the duty does not cover exploited flaws a maker already knew about before 11 September.

Fifteen days remain, and the 374 vendors without a standard inbox are still on the clock the moment a researcher, a customer, or a CSIRT makes them aware. CRA Incident Drill’s published curl loop is one request per domain; it still prints “missing” on three names out of four in that European list.

Frequently Asked Questions

What is a security.txt file?

It is a plain text file at https://example.com/.well-known/security.txt that tells researchers how to report a flaw. RFC 9116 requires a Contact field that uses a URI (mailto, tel, or https) and an Expires date; the 2025 Web Almanac found that about 25 percent of published files still omit a valid expiry and so are not fully valid even when Contact is present.

When do the Cyber Resilience Act’s Article 14 reporting rules start?

They apply from 11 September 2026, 21 months after the Act entered into force on 10 December 2024. Most other CRA duties, including Annex I’s essential cybersecurity requirements, apply from 11 December 2027, and Chapter IV on notifying conformity assessment bodies applied from 11 June 2026.

Does Article 14 apply to products already on the market?

Yes. The Commission’s CRA summary says reporting covers all products with digital elements made available on the Union market, including those placed there before 11 December 2027. ENISA’s FAQ adds that makers do not have to report exploited flaws they already knew about before the reporting rule itself applies.

Who receives an Article 14 notification?

The maker files once through ENISA’s Single Reporting Platform. The notice goes to the CSIRT of the member state of the maker’s main establishment and, except in rare cases, to ENISA at the same time, and that CSIRT then shares it with CSIRTs in other member states where the product is available. A December 2025 delegated act sets when a CSIRT may delay that extra sharing on cybersecurity grounds.

Is a security.txt file required on 11 September 2026?

No. Article 14 requires a report after the maker becomes aware of an actively exploited flaw or a severe incident. The Annex I duties to enforce a coordinated disclosure policy and to provide a contact address apply from 11 December 2027 with the rest of the product rules, so the file is still the lookup path researchers use, not the 11 September legal test.

Disclaimer: This article is news reporting and analysis of a published scan and of public EU and national guidance. It is informational only and is not legal advice, compliance advice, or a determination of whether any company is in or out of scope of the Cyber Resilience Act. Readers who need to design a disclosure policy, a reporting workflow, or a filing under Article 14 should consult a qualified EU product-security or regulatory lawyer, and where relevant their national CSIRT, before acting. Figures, platform status and legal dates reflect the sources as of 27 August 2026 and may change as ENISA’s Single Reporting Platform and Commission guidance are updated.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

NEWS

The 96 Percent Lunar Eclipse California Mostly Missed

Thursday’s lunar eclipse covered 96.3% of the Moon, but Tropical Storm Iselle’s leftover clouds hid the copper disk in the Bay Area.

Published

on

By

partial lunar eclipse 96 percent copper moon California

Earth’s dark inner shadow covered 96.3% of the full Moon at 9:13 p.m. Pacific on Thursday, leaving a thin bright cap on the northern limb that kept the eclipse just short of total. Across the Americas the disk went copper. In the Bay Area, leftover moisture from former Tropical Storm Iselle filled the southern sky with the clouds Chronicle meteorologist Greg Porter had tracked all day.

The local forecast was a lottery. The geometry was not. This was the deepest lunar eclipse anyone on Earth will get until New Year’s Eve 2028, and California’s next true total does not arrive until June 2029.

A 96% Eclipse Still Painted the Moon Copper

NASA’s Scientific Visualization Studio, in work by visualizer Ernie Wright, put greatest eclipse at 4:13 a.m. Universal Time on August 28, when 96.3% of the Moon’s disk sat inside the umbra, the central shadow where Earth fully blocks the Sun. Timeanddate’s independent reduction listed the same event at 4:12:53 UTC with an obscuration of 96.2% and an umbral magnitude of 0.930, the fraction of the Moon’s diameter inside that shadow.

Those two numbers are easy to mix up. Magnitude is a width. Obscuration is an area. Because only a narrow cap stayed in sunlight, the shadowed share of the disk looked much closer to total than “93% of the width” sounds. NASA’s page says obscuration is the figure that matches what your eye actually sees.

THE 96.3 PERCENT ECLIPSE

  • Greatest eclipse: About 9:13 p.m. PDT on August 27, which is 12:13 a.m. EDT on August 28.
  • Partial phase: From 7:34 p.m. to 10:52 p.m. Pacific, a span of 3 hours 18 minutes.
  • Whole event: 5 hours 38 minutes from first penumbral shading to last.
  • The leftover sliver: Roughly 3.8% of the face stayed outside the umbra, along the northern limb.

On the West Coast the Moon rose already in trouble. Timeanddate’s San Francisco Bay Area solution has moonrise at 7:38 p.m. PDT, four minutes after partial eclipse began, with the Moon only 16.6° above the horizon at maximum. The SETI Institute’s San Jose card put moonrise at 7:35 p.m. and the end of the partial phase at 10:51 p.m. You did not need a telescope, and you did not need eclipse glasses. You needed a hole in the weather, and a view toward the east-southeast.

E.C. Krupp, director of Griffith Observatory in Los Angeles, wrote to SFGATE before the event that the miss was the point of the night.

This eclipse just misses totality, and that is its charm. It should look a lot like a total lunar eclipse, coppery red with a pearly highlight on top.

E.C. Krupp, director, Griffith Observatory, quoted by SFGATE

Gerald McKeegan, an astronomer at Oakland’s Chabot Space & Science Center, told KQED the same geometry in plainer words: almost the whole Moon red, “just a little sliver up at the north part of the moon” still light. Sky & Telescope described that sliver as silvering the northern limb while the rest of the disk glowed like a smoldering sunset, with a pale turquoise band possible where stratospheric ozone eats red light.

Iselle’s Leftover Moisture Hid the Bay Area Moon

The clouds that wrecked the view did not grow over the Golden Gate. They were a ribbon of tropical air pulled north from a storm that was never coming ashore. Porter’s separate Chronicle weather piece on Thursday said moisture from Iselle, a former tropical storm, would leak into the Bay Area and fill the sky with puffy and wispy clouds, “setting the stage for a colorful sunset but also ruining visibility for the partial lunar eclipse set to peak between 7 and 10 p.m.” The National Weather Service put measurable rain at 15%. The eclipse was the more likely casualty.

The National Hurricane Center’s Iselle’s last forecast advisory, number 15 at 0300 UTC Thursday, listed the post-tropical cyclone near 23.0°N, 125.9°W, about a thousand miles west of Baja, with 30-knot winds and a 1002 millibar center, drifting west-northwest and due to dissipate within a couple of days. An upper-level trough digging down the California coast scooped a sliver of that moisture and ran it over the state. Porter compared the setup to a mini atmospheric river that would not soak anyone, just spread virga and mid-level junk through the Santa Cruz Mountains, the East Bay hills, and the coastal range.

THURSDAY ON THE GROUND

  1. Thursday morning, August 27: A plume of thick cloud is already on the Central Coast and Southern California, with NHC listing Iselle as a remnant low far at sea.
  2. 3 p.m. to 5 p.m. PDT: Porter’s eclipse forecast has the overcast overspreading the South Bay, the Peninsula, San Francisco, and much of the East Bay, then feeding on Pacific moisture for the rest of the night.
  3. 7:13 p.m. PDT: Porter posts that former Iselle is ruining Bay Area viewing, hours before maximum.
  4. 7:25 p.m. PDT: Griffith Observatory canceled the public lawn viewing because of heavy clouds and possible rain, and kept an online broadcast window instead.
  5. 8:30 p.m. PDT: Porter’s update finds moisture-laden clouds breaking a bit over San Francisco and Oakland, with the thicker stuff still parked to the south, exactly where the Moon is.
  6. 9:13 p.m. PDT: Greatest eclipse. North Bay, Santa Rosa, Napa, and the Mayacamas still hold the best odds. The coast and South Bay are largely out.

Amateur observers in the city said the cover was thickening in the 90 minutes before moonrise, and that it had been about a decade since a lunar eclipse was actually seen from San Francisco. South Bay watchers described the same deck. The night was a patchwork even outside California. Some people sat for two hours and lost maximum to a single bank. Others got a clean look when a hole opened at the right minute. Coastal California drew the short straw because the dense mid-level cloud, the 5,000-to-15,000-foot stuff Porter had flagged as a near guarantee of a miss, sat in the southern sky. High, thin cloud above 20,000 feet can open. That thicker layer does not.

Chabot still listed a watch party from 7 p.m. to 10 p.m. in the Oakland Hills, with a livestream from farther east if the marine layer won at home. KQED quoted NWS meteorologist Roger Gass saying most of the region would sit under typical low fog, with later-arriving cloud possible in Livermore, Concord, San Mateo, and San José, and even those cities carrying some high cover.

3.34 Billion People Could See the Shadow

The Bay Area argument was local weather. The eclipse itself was a hemispheric event. Timeanddate, using CIESIN population grids, counted 3.34 billion people in the night side who could catch at least some of the partial phase, about 41% of the world. Some 1.28 billion could watch the whole partial, and 987 million could see every stage from penumbra in to penumbra out. NASA listed visibility from the Americas except Alaska and northwestern Canada, plus western Europe and western Africa.

Andrew Fraknoi, professor emeritus of astronomy at Foothill College, told the Bay Area News Group the West Coast timing was the gift. Peak arrived after dinner, not after midnight, so children could stay up for it. The same clock worked against the Pacific coast in another way. Partial eclipse began at 7:34 p.m. PDT, right around moonrise, so the first bite happened on a dim, low Moon. East of the Rockies the Moon was already well up.

Time zone Partial begins Maximum Partial ends
Pacific (Aug 27) 7:34 p.m. 9:13 p.m. 10:52 p.m.
Mountain (Aug 27) 8:34 p.m. 10:13 p.m. 11:52 p.m.
Central (Aug 27) 9:34 p.m. 11:13 p.m. 12:52 a.m. Aug 28
Eastern 10:34 p.m. Aug 27 12:13 a.m. Aug 28 1:52 a.m. Aug 28

NASA’s own explainer on Thursday put the peak at about 9:13 p.m. PDT, 12:13 a.m. EDT, and 4:13 a.m. UTC, and repeated that a lunar eclipse is safe to watch with unprotected eyes, binoculars, or a telescope at every stage. The agency’s solar-system account posted Wright’s visualization two days earlier, with the same 96% figure and the same Eastern-time card.

https://x.com/NASASolarSystem/status/2092733830394261960

Matt Devitt, a Florida meteorologist whose viewing note circulated widely before the night, called weather the only wild card and framed the event as one of the best lunar eclipses from the United States until the next total in December 2028. Replies under that post defaulted to a familiar complaint: the sky will cloud up, or the neighbor’s security lights will wash out the red. Both showed up in real time from Alabama to Maryland to the Piedmont, where people shot the copper disk through brief breaks and then lost it again.

Why the Shadowed Moon Turns Red

The copper is leftover sunlight, bent through Earth’s atmosphere and stripped of its blue. NASA’s lunar-eclipse notes walk through why the Moon turns reddish-orange with the same physics that makes the daytime sky blue and a sunset red. Short wavelengths scatter off air molecules. Longer red and orange wavelengths keep going, then refract into the umbra and hit the lunar surface. NASA has described the result as all the world’s sunrises and sunsets projected onto the Moon.

Dust, smoke, volcanic ash, and cloud along Earth’s limb change the mix. Fraknoi told KQED the glow would depend in part on the “sooty-ness” of the atmosphere that night. More junk in the air, and the Moon goes darker and redder. A cleaner limb can look copper-orange, even brick, with a brighter yellow rim. French astronomer André Danjon’s old five-point scale, still cited on NASA’s eclipse site, runs from L=0, a Moon almost invisible at mid-eclipse, to L=4, a bright copper-orange disk with a bluish rim. Thursday was a partial, so the scale is a cousin rather than a perfect fit, but the shadowed 96% still took that same filtered light.

Wright’s NASA visualization even mimics the way human eyes adapt. Less than an hour after the umbra takes its first bite, the remaining sunlit sliver shrinks enough that the copper in the shadow becomes visible. The movies raise the apparent exposure around greatest eclipse to match that adaptation. If you only glanced up at 8 p.m. Pacific, you saw a dark bite. If you stayed until 9, and if you had sky, the red was the show.

The Last Deep Lunar Eclipse Until 2028

This eclipse closed a tight run. Wikipedia’s catalog of the August 2026 event, drawing on the standard Espenak-Meeus canon, calls it the last of an almost tetrad after total lunar eclipses on March 14, 2025, September 8, 2025, and March 3, 2026. NASA’s 2021-2030 lunar list puts March 3 at 58 minutes of totality and August 28 as a partial in Saros 138, with a 3-hour 18-minute partial phase. Then the calendar goes quiet for anyone who wants a fully immersed Moon.

February 20, 2027, and August 17, 2027, are penumbral, a shading so gentle many people never notice it. January 12, 2028, is a shallow partial. July 6, 2028, is another partial aimed at Europe, Africa, Asia, and Australia. The next total is December 31, 2028, with 1 hour 11 minutes of totality for Europe, Africa, Asia, Australia, and the Pacific. NASA’s Moon portal already lists that New Year’s Eve total as the next one on the board.

Date (UTC) Type Notes for North America
March 3, 2026 Total 58 minutes of totality; many West Coast viewers had a pre-dawn slot
August 28, 2026 Deep partial 96.3% of the disk in umbra, evening on the West Coast
February 20, 2027 Penumbral Shading only, easy to miss
August 17, 2027 Penumbral Again a faint outer-shadow event
January 12, 2028 Partial Shallow umbral bite
December 31, 2028 Total 1 hour 11 minutes of totality; California sees it as a partial
June 26, 2029 Total 1 hour 42 minutes of totality, evening moonrise for Northern California

Ben Burress, a staff astronomer at Chabot, told the Mercury News the Thursday event was not quite total. McKeegan told KQED it was still the show to catch, because the next total visible to the Bay is not until June 2029. Space.com, as quoted by the Sacramento Bee, called this the first very deep partial since September 2024 and the most impressive lunar sight for a while, with a wait until December 2028 for a full lunar eclipse in North America. Those dates line up with NASA’s table even when the adjectives differ.

What California Waits For Until June 2029

June 26, 2029, is a central total, one of the long ones. Fred Espenak’s EclipseWise pages give 102.7 minutes of totality, more than 100 minutes, with the Moon near the shadow’s axis. Timeanddate’s Northern California solution is less glamorous at ground level: moonrise at 8:36 p.m. on June 25 local time, with maximum in Northern California at 8:39 p.m. while the Moon is still scraping the horizon. You will be looking east through whatever June stratus the coast cooks up that night. You will also be looking at a fully immersed Moon, not a 4% sliver.

In between, this is what the U.S. actually gets:

  • August 16-17, 2027: A penumbral lunar eclipse visible from all states, a dimming without a red disk.
  • January 11-12, 2028: A partial lunar eclipse visible from all states, much shallower than Thursday’s 96%.
  • December 31, 2028: A total lunar eclipse at the source, but only Alaska, Hawaii, and Washington sit in totality from the U.S., with California listed for a partial view.
  • June 25-26, 2029: The next total from California, long totality, low Moon at the start.

Thursday was the convenient one. Peak at 9:13 p.m. Pacific, Moon in Aquarius, Sturgeon Moon by the almanac name, no 3 a.m. alarm. The March 2026 total, McKeegan noted, peaked at 3:33 a.m. for Bay Area clocks. People slept through a real blood moon and then stood in a parking lot six months later for a 96% substitute, only to watch Iselle’s leftover water vapor take the southern sky.

Porter’s 8:30 p.m. update still left a door cracked. Moisture-laden clouds were breaking over San Francisco and Oakland, and high, thin cover can open. The thicker deck stayed south, on the Moon’s heading. Some North Bay towns, and anyone who drove into the Mayacamas, had the cleaner shot. By then Griffith’s lawn was closed, the livestream was the backup, and the geometry that made 96.3% look total was doing its work for everyone who had sky. The next time California gets the whole umbra, on a summer evening in 2029, the leftover tropical storm will be a different one, or none at all.

Frequently Asked Questions

Do you need eclipse glasses to watch a lunar eclipse?

No. NASA’s eclipse safety page says it is safe to look at the Moon with unprotected eyes or through a telescope during all types and all stages of a lunar eclipse, because you are looking at sunlight that has already been reflected off the lunar surface. Solar eclipse glasses are the wrong tool here. Binoculars help the copper show up sooner once the umbra has taken a large bite, and they make the bright northern sliver easier to pick out against the shadowed face.

When is the next total lunar eclipse after August 2026?

The next total anywhere on Earth is December 31, 2028, with 1 hour 11 minutes of totality for Europe, Africa, Asia, Australia, and the Pacific. NASA’s decade table then lists June 26, 2029, at 1 hour 42 minutes of totality for the Americas, Europe, Africa, and the Middle East, which is the next total McKeegan timed for Bay Area viewers. There is no total lunar eclipse at all in 2027, only penumbral events.

What saros cycle did the August 2026 lunar eclipse belong to?

Saros 138. NASA’s visualization page notes that eclipses in a given saros are separated by 18 years, 11 days, and 8 hours. The previous member was August 16, 2008. The next is September 7, 2044. Thursday’s eclipse was number 29 of 82 in that series, a deep partial rather than a total because the Moon’s track missed the umbra’s center by enough to leave that northern cap in sunlight.

What is the difference between eclipse magnitude and obscuration?

Umbra magnitude is the fraction of the Moon’s diameter covered by Earth’s dark inner shadow. For Thursday that value was 0.930, or about 93% of the width. Obscuration is the fraction of the Moon’s area inside the umbra, 96.3% on NASA’s figure and 96.2% on Timeanddate’s. Magnitude can exceed 1.0 in a total eclipse, which is how catalogs describe how deeply the Moon plunges through the shadow. NASA uses the June 2029 total, magnitude 1.84, as the example of a number that no longer means “percent of the Moon you see covered.”

Can a partial lunar eclipse still count as a blood moon?

Astronomers do not love the phrase, which Timeanddate notes is popular rather than scientific, but a deep partial can still go copper because most of the disk is already in the umbra, taking that filtered red light. Almanac writer Joe Rao likened Thursday’s leftover sliver to a red-orange Japanese lantern. The 3.8% still in sunlight kept it from totality on paper. For anyone who had clear sky, the red was already on the other 96%.

Continue Reading

ENTERTAINMENT

Apple TV Hikes Subscriptions to $14.99 and $119

Apple TV rose to $14.99 a month as MLS and F1 landed in the base plan, with the yearly rate up 20% to $119.

Published

on

By

Apple TV subscription price increase to $14.99 monthly

Apple TV now costs $14.99 a month in the United States, up from $12.99, and the yearly plan rose from $99 to $119. It is the fourth U.S. price rise since 2022 for a service that launched at $4.99 in 2019. Apple One’s cheapest bundle moved to $21.95 a month from $19.95.

TechCrunch first flagged the new rates on Friday morning. Variety said the U.S. change was effective immediately, and TVLine said the new rates apply Friday for new subscribers. Apple’s own TV storefront already listed $14.99 the same day.

The Annual Plan Took the Hardest Hit

The $2 monthly bump is the headline. The yearly jump is the one that changes the math. Last August, Apple lifted the monthly rate from $9.99 to $12.99 and left the yearly plan at $99, a discount that PCMag and TidBITS both treated as the way to dodge the hike. That freeze lasted one year.

THE NEW U.S. RATES

  • Monthly plan: $12.99 to $14.99, a $2 rise of about 15%.
  • Yearly plan: $99 to $119, a $20 rise of about 20%.
  • Apple One Individual: $19.95 to $21.95, a $2 rise of about 10%.

Twelve months at $14.99 would cost $179.88. At $119 a year, the prepaid plan still comes out to about $9.92 a month, a saving of $60.88 if you stay the whole year. Last year’s $99 yearly rate saved $56.88 against $12.99 monthly billing, so the dollar saving is slightly larger and the percentage saving is slightly thinner. People who locked in $99 last fall to beat the $12.99 monthly rate now face a 20% jump at renewal.

Soccer, Formula 1, and the End of Season Pass

Apple is no longer selling a boutique originals app that happens to carry some games. The company now advertises live sports at no extra cost, naming Formula 1 races, MLS matches, and Friday Night Baseball on the same page as the $14.99 rate. That packaging is the bill behind the new price, not a memory-chip shortage.

MLS and Apple spent three seasons selling a separate Season Pass on top of Apple TV. Sports Business Journal reported that the 10-year rights pact that started in 2023 is worth $2.5 billion, about $250 million a year, and that from the 2026 season every regular-season match, Leagues Cup, All-Star Game, Campeones Cup, and playoff game sits inside a standard Apple TV plan. Season-ticket holders who used to get Season Pass now get a yearly Apple TV plan instead. Portland Timbers owner Merritt Paulson told SBJ he expects the league to “double our viewership” in 2026 because of that move.

Season Pass used to cost $14.99 a month or $99 a season on its own, or $12.99 a month and $79 a season for people who already paid for Apple TV. Folding that inventory into the base plan means the old upcharge is gone and the base plan is the one that rose.

WHAT NOW COMES WITH THE $14.99 PLAN

  • Formula 1: Apple and Formula 1 announced a five-year U.S. pact in October 2025. Subscribers get practice, qualifying, Sprint sessions, and Grands Prix, and F1 TV Premium is included. Select races and all practice sessions stream free in the app. BBC Sport reported the deal is worth about $750 million, about $150 million a year, up from ESPN’s prior U.S. fee of about $80 million a year. Apple has not published its own dollar figure.
  • Major League Soccer: Every club, no blackouts, plus studio shows, after Season Pass shut down as a standalone product.
  • Friday Night Baseball: Regular-season doubleheaders on Fridays, still sold as part of the same plan rather than a separate pass.

Eddy Cue, Apple’s senior vice president of Services, tied the F1 deal to the subscription itself, not to a pay-per-view add-on.

We’re thrilled to expand our relationship with Formula 1 and offer Apple TV subscribers in the U.S. front-row access to one of the most exciting and fastest-growing sports on the planet.

Eddy Cue, senior vice president of Services, Apple Newsroom

The louder objection on Friday was not the $2. It was the catalog around those games. Apple’s originals still carry the reputation. The licensed movie shelf does not, and $14.99 makes that gap harder to ignore for anyone who is not watching soccer or Grand Prix weekends.

$4.99 Became $14.99 in Four Steps

Apple TV, then branded Apple TV+, launched on November 1, 2019, at $4.99 a month, or $49.99 a year per PCMag’s timeline. The first U.S. hike arrived three years later. Each later step has been shorter.

Date Monthly Yearly What moved with it
November 2019 $4.99 $49.99 Launch price, no ads
October 2022 $6.99 $69 First hike; Apple One Individual to $16.95
October 2023 $9.99 $99 Arcade and News+ rose; Apple One Individual to $19.95
August 2025 $12.99 $99 (unchanged) Apple One left alone
August 2026 $14.99 $119 Apple One Individual to $21.95

From $4.99 to $14.99 is a $10 rise, a 200% climb in under seven years. CableTV.com’s 2026 pricing guide put the inflation-adjusted launch price near $6.35 and noted the service had already outrun that line at $12.99. The new $14.99 rate widens that gap again. PCMag says Apple dropped the “+” from the name in October 2025, around the F1 announcement, which is when the product stopped presenting itself as a plus-one and started presenting itself as a full TV service.

Apple One Still Looks Like the Better Deal

Apple did not touch every bundle tier today. On July 17 it raised Apple Music’s Individual plan from $10.99 to $11.99 and Family from $16.99 to $19.99, and it lifted Apple One Family from $25.95 to $27.95 and Premier from $37.95 to $39.95. Individual Apple One stayed at $19.95 through that Music hike. Six weeks later, that protected tier is the one that moved with TV.

Apple now says the Individual plan is $21.95 per month, with Family still $27.95 and Premier still $39.95. Individual includes Music, TV, Arcade, and 50GB of iCloud+. Apple’s page claims a $13 monthly saving, or 31%, versus buying those parts apart. Family and Premier still advertise $17 and $35 in monthly savings.

The upsell gap is the quiet design choice. Apple One Individual now costs $6.96 more than standalone TV at $14.99. In July it cost $6.96 more than TV at $12.99. Apple raised both by $2 and left that gap exactly where it was, so the extra dollars for Music, Arcade, and 50GB of storage did not get more expensive relative to TV. The yearly TV plan, which is not inside Apple One, is the product that took the 20% hit.

People who already pay for Apple One felt less of Friday’s news, and that is the point of keeping the bundle gap flat. The stack still hides a TV hike better than a standalone bill does.

What $14.99 Buys Against Netflix and Peacock

At $14.99, Apple TV is still cheaper than Netflix’s $19.99 Standard plan and Peacock’s $19.99 ad-free Premium Plus, and it still runs without ads on Apple Originals. The gap is the library. Apple is selling originals plus live sports, not a deep back catalog, and Netflix remains the plan you buy when you want the shelf to be endless.

Netflix raised U.S. prices in March, taking Standard with ads to $8.99, Standard to $19.99, and Premium to $26.99. Peacock moved on August 18, its fourth hike in four years: Select to $8.99, Premium (with ads) to $12.99, and Premium Plus to $19.99. Disney+ Premium, last raised in October 2025, sits at $18.99. Apple now prices above Peacock’s ad tier and well below Netflix’s ad-free Standard tier.

Service Ad-free monthly (U.S.) Last move
Apple TV $14.99 August 2026, from $12.99
Peacock Premium Plus $19.99 August 18, 2026, from $16.99
Disney+ Premium $18.99 October 2025, from $15.99
Netflix Standard $19.99 March 2026, from $17.99

Cord Cutter Weekly’s August 28 deals list still showed an Apple TV and Peacock Premium combo from $14.99, or $19.99 with ad-free Peacock. If that combo rate holds at $14.99, it now matches standalone Apple TV, which would make the Peacock add-on look almost free until NBCUniversal resets it. Treat that list price as a snapshot from Friday, not a promise it survives the Apple change.

Ampere Analysis, in a survey published by TV Tech this week, found that average price rises at Netflix, Disney+, and Amazon had slowed from 24% of the prior rate in 2023 and 2024 to 14% in 2025 and 2026. Apple’s monthly move sits near that newer average. Its yearly move does not.

Services Already Mint $30.7 Billion a Quarter

Apple can lift a streamer that still has a thin movie shelf because the streamer is not the business. For the fiscal third quarter ended June 27, Apple reported revenue of $109.4 billion, up 16%, and Services revenue of $30.7 billion, up 12% from $27.423 billion a year earlier. Services cost of sales was $7.494 billion, which is why that line still funds originals, soccer, and F1 without needing Netflix-like scale. “Today, Apple is proud to report our strongest June quarter ever, with double-digit revenue growth across iPhone, Mac and Services, and in every geographic segment,” said Tim Cook, Apple’s CEO, in the July 30 results release.

Hardware is getting less gentle in the same season. In June, Apple raised the Apple TV 4K streaming box from $129 to $199 for Wi-Fi and from $149 to $249 for Wi-Fi plus Ethernet, and it lifted HomePod and HomePod mini. “We have never seen a component price increase this much, this quickly,” Apple said then, pointing at memory and storage demand from AI data centers. This week the company is also selling the $899 Mac mini built for always-on AI into that same memory market. TechCrunch tied those parts shortages to Friday’s TV hike. The cleaner through-line is the one on Apple’s TV page: races, matches, and Friday doubleheaders now sit in the plan you already pay for, and $14.99 is what that plan costs.

Frequently Asked Questions

Does Apple TV still offer a free trial?

New customers still get a 7-day free trial, then $14.99 a month. If you buy an eligible iPhone, iPad, Mac, or Apple TV 4K and redeem the offer within 90 days, Apple includes three months of the service at no extra charge, which is the longer free window for anyone already buying hardware.

Can a family share one Apple TV plan?

Yes. Family Sharing covers up to six people on a single Apple TV plan, including the organizer, and they do not need to share a password. Apple TV and Arcade also keep Family Sharing even inside the Apple One Individual bundle, which otherwise does not share Music or iCloud+ the same way.

Do students get Apple TV for less?

The Apple Music Student Plan includes Apple TV at no extra cost after a one-month Music trial, so a qualifying student who already wants Music does not pay the $14.99 TV rate on top. That path is separate from Apple One and from the hardware promo.

Do you need an Apple TV 4K box to watch?

No. The Apple TV app runs on iPhone, iPad, many smart TVs, streaming sticks, game consoles, and at tv.apple.com, and Apple Originals can be downloaded for offline playback on Apple devices. The 4K box is optional hardware, and its own price rose in June, independent of the streaming plan.

Continue Reading

NEWS

Meta’s Teen Settlement Puts the Extra Bill on TikTok

Meta’s $17.1 billion teen deal holds back about $5.3 billion unless TikTok and YouTube take a one-hour cap and pay.

Published

on

By

Meta teen social media addiction settlement time limits

Meta settled a 47-state teen-addiction case Wednesday for up to $17.1 billion and a two-hour daily cap on Instagram and Facebook. Judge Yvonne Gonzalez Rogers entered the consent judgment in Oakland, ending a trial that had opened on August 18.

The same paperwork holds back about $5.3 billion unless TikTok and YouTube take a tighter cap and pay. Meta’s first public line after the deal named those two companies.

The $5.3 Billion Pays Only If Rivals Fold

New York Attorney General Letitia James said the coalition locked in at least $12.1 billion to coalition states, with the figure rising to $17.1 billion if other major platforms reach similar deals. Meta’s newsroom used a wider tally of about $18 billion, of which participating states receive about $12.7 billion over 10 years, or roughly 70%.

The remaining 30%, about $5.3 billion on Meta’s math, is released only after two conditions. YouTube and TikTok must add a one-hour daily limit, a night mode, and age checks. Each must also pay an amount matching that 30% slice, with half of Meta’s leftover tied to YouTube’s check and half to TikTok’s.

Slice Stated amount What unlocks it
Guaranteed to settling states At least $12.1 billion (NY AG); about $12.7 billion (Meta) Annual installments over 10 years
Contingent remainder About $5.3 billion (Meta) YouTube and TikTok add a 1-hour cap, night mode, and age checks, and each match the payment
Meta’s combined company tally About $18 billion Includes Texas, which Meta listed among 52 attorneys general
Q3 2026 legal charge About $10 billion Accrued to this agreement, Meta said; not in July guidance

CBS News reported that a Meta spokesperson described a separate Texas deal of about $1 billion that helps get the company to that $18 billion figure. Washington’s release does not list Texas in the $17.1 billion coalition. Florida is absent from both lists.

Meta will book about $10 billion in the third quarter for the agreement, a charge it said was not in the expense range from the July earnings call. For 2025, Meta reported revenue of $200.966 billion, operating income of $83.276 billion, and net income of $60.46 billion. The guaranteed decade of state payments is a single year of profit with change left over.

Two Hours a Day, With Exceptions Written In

California Attorney General Rob Bonta said the product terms are changes that take effect within months, not after another round of legislation. Parents can lift the defaults. Direct messages stay outside the clock.

The teen defaults Meta listed:

  • Daily cap: Two hours across Facebook and Instagram, counted even if Meta detects multiple accounts, and off only with a parent’s permission.
  • Night block: Midnight to 6 a.m., with no posting or viewing of Feed, Stories, Explore, or Reels.
  • School mute: Push alerts off from 8 a.m. to 3 p.m., except direct messages and security or safety alerts.
  • Scroll breaks: Prompts after every 15 minutes of continuous use, and again when daily use hits 60 and 90 minutes.
  • Feed and likes: A non-algorithmic feed teens can choose, with parent power to make it the default, plus hidden like and reaction counts.
  • Filters: A ban on extreme makeup filters, on top of the existing block on cosmetic surgery filters for teens.

If Snapchat, TikTok, and YouTube take comparable terms, Washington Attorney General Nick Brown said the daily cap on each Meta app drops to 60 minutes for 10 years. Meta’s own write-up matches that tighter clock and stretches night mode to 10 p.m. through 7 a.m. Until then, time limits and night mode start as a five-year promise. Most other terms run 10 years.

Bonta’s office also locked a report-handling rule the company newsroom did not headline: Meta must respond to 90% of teens’ harm reports within six hours. School-hour quiet time in that filing runs 8 a.m. to 3 p.m. from August 15 to June 15.

Zuckerberg Never Took the Stand in Oakland

The states had accused Meta of designing Facebook and Instagram to keep young users hooked, then misleading families about the risk, and of collecting data on children under 13 in violation of the Children’s Online Privacy Protection Act. Meta denied the claims in the judgment and still denies liability.

The path to Wednesday’s filing:

  1. 2021: Attorneys general opened a joint investigation of how platforms were built and sold to children, Brown’s office said.
  2. October 2023: James and 32 other attorneys general sued, alleging infinite scroll, constant alerts, and feeds that steered teens toward eating-disorder and self-harm posts.
  3. August 18, 2026: Trial opened in Oakland with California, Colorado, Kentucky, and New Jersey as the live plaintiffs.
  4. The first week: Arturo Béjar, a former Meta engineering director, testified that the apps were built to hold attention even when that hurt mental health.
  5. August 26, 2026: The parties filed the deal; Gonzalez Rogers entered the consent judgment the same day, according to court papers.

Béjar told the court, “If you step away from the product, they are not going to make any money.” Wired reported that Instagram head Adam Mosseri was due back on the stand the morning the deal landed, and that the trial was not a quarter of the way through a planned 19-day run. Mark Zuckerberg did not testify.

Ars Technica reported that Meta had told the court some states’ damages theories ran above $1.4 trillion. The Atlantic put the states’ working trial figure near $200 billion. Ending in week two also ended the public reading of more internal research. An independent auditor will test Meta’s compliance each year for five years, and the deal sets up a research foundation that will receive consented user data.

California Is in Line for $2.1 Billion

Cash follows population and the 10-year calendar. James said New York will receive at least $819 million and up to $1.15 billion, money her office wants used for phone-free classroom grants, clinician training, after-school programs, and public-health work. Bonta said California will receive $1.5 billion to $2.1 billion, with the legislature and governor still to decide the split, though the filing earmarks it for preventing or repairing youth harm tied to social media.

Office Stated share Source
California $1.5 billion to $2.1 billion Bonta release
New York $819 million to $1.15 billion James release
New Jersey At least $525 million CBS News, from state AGs
Massachusetts At least $366 million CBS News, from state AGs
Virginia $353 million CBS News, from state AGs
Washington $237 million guaranteed, up to nearly $339 million Brown release
Georgia Nearly $100 million, up to $135 million CBS News, from the AG’s office

Brown called the pact the largest state consumer protection settlement outside the 1990s Big Tobacco deals. Washington also takes an extra $10.2 million on a Cambridge Analytica resolution folded into the same papers. Georgia Attorney General Chris Carr said Meta was first to the table and should not be last.

The dollars move to state governments. Brown said his office will use a portion for attorney costs and consumer-protection work, plus programs on youth mental health. That is the part of the deal that reads like a fine to the public and like a budget line to the states. Individual teens who lost sleep do not get a check.

James Uthmeier, Florida’s attorney general, told CNET the state payouts are “peanuts” next to the harm, called the agreement “a slap on the wrist for a trillion-dollar corporation that has already paid more to its lawyers than it will pay the states,” and said Florida will see Meta at trial. New Mexico is also missing from the NY and Washington sign-on lists after a separate spring case. Meta’s own roster of 52 offices still omits both.

What Teens Can Still Open After Midnight

Night mode, the two-hour cap, and school mute do not apply to direct messaging, Meta said, so teens can keep talking to friends and family. Security and safety alerts also continue during school hours. The feed goes dark. The chat does not.

That hole is large if the harm the states described lives in group chats as much as in Reels. Parents who never turn on supervision tools will still see a two-hour clock and a midnight wall on the public surfaces, and a live message thread under both. Meta launched Teen Accounts in 2024 with tighter messaging and privacy defaults. Béjar’s point in Oakland was that engagement is the business, and former staff have argued those earlier switches did little.

Age checks are the other hinge. Meta said it will spend more on tools that catch under-13 accounts and that place 13-to-17 users into teen experiences even when they type an adult birthday. It also said app stores should pass verified ages to developers, a fight that sits with Apple, Google, and legislatures, not with this judgment. If a 14-year-old keeps an adult birthday, the two-hour cap never starts.

Meta’s Letter Names TikTok and YouTube

C.J. Mahoney, Meta’s chief legal officer, tied the whole bargain to companies that were not in the courtroom.

Our new Time Limit commitments, Night Mode features and usage limits during school hours set the right path forward for our whole industry, but this framework will only work if all our peers join us. Because teens move fluidly across dozens of apps, we need an industry-wide solution. We therefore call on our industry peers, TikTok and YouTube, to implement this new framework, right away.

C.J. Mahoney, Chief Legal Officer, Meta newsroom, August 26, 2026

The company posted an open letter aimed at TikTok and YouTube the same day and, Reuters reported, planned to run it in national newspapers on Thursday. HuffPost, citing New York Times reporter Mike Isaac, said the ad was slated for The New York Times, The Washington Post, and the Los Angeles Times. Reuters said TikTok and YouTube were not immediately available for comment, and a Meta spokesperson was “hopeful” Snap would move even though the letter does not name Snap. Washington’s term sheet does.

The ask is not symmetrical. Meta accepted two hours unless the others join. The others are being told to start at one hour, and to pay, before Meta’s leftover $5.3 billion moves. If they refuse, Meta keeps that slice and still sells the two-hour cap as the industry standard. James already has a separate suit against TikTok, which is the next obvious docket if this template is the point.

Bonta put the California version on the record Thursday morning.

https://x.com/RobBonta/status/2092831280790655115

Frequently Asked Questions

How much will Meta pay in the teen safety settlement?

James’s office set the coalition ceiling at $17.1 billion over 10 years, with $12.1 billion due even if no other platform settles; New York’s own band is $819 million to $1.15 billion, and she listed school phone-ban grants and clinician training as intended uses. Meta’s books use about $18 billion, a 70/30 split, and a $10 billion charge in the third quarter of 2026.

What daily time limit will Instagram and Facebook impose on teens?

The default is two hours a day combined, including extra accounts Meta detects, and a parent must approve any override. If Snapchat, TikTok, and YouTube take matching terms, that cap falls to 60 minutes on each Meta app and stays for 10 years instead of five.

Which states did not join the Meta settlement?

Florida’s attorney general rejected the money and said he will try the case; New Mexico is not on the sign-on lists released by New York and Washington after its own spring trial. Meta’s published list of 52 offices includes Texas and still leaves those two out.

How long will Meta’s new teen rules stay in force?

Most injunctive terms run 10 years. Time limits and night mode begin as a five-year commitment and extend to 10 years only if named peers sign on, which is also when night hours expand from midnight-6 a.m. to 10 p.m.-7 a.m. An independent auditor reports to the states each year for five years.

Do Meta’s night and time limits apply to direct messages?

No. Meta carved messaging out of Night Mode, the daily cap, and School Mode so teens can still reach friends and family, and school-hour muting still allows account-security and safety alerts. Public feeds, Stories, Explore, and Reels are what go dark after midnight.

Uthmeier still has a trial date. TikTok still has James’s complaint. Meta has a two-hour clock, a dark feed after midnight, and a $5.3 billion remainder that moves when those other apps blink.

Disclaimer: This article is news reporting on a court-approved settlement and related public statements, and it is for information only. It is not legal advice, medical advice, or guidance on any claim against Meta, TikTok, YouTube, Snap, or a state attorney general. Readers who think a child’s account, a pending case, or a health issue is at stake should talk to a licensed attorney or a qualified clinician before they act. Payment figures, product rules, and who has signed on reflect the cited filings and releases as of August 27, 2026, and can change if a court, a holdout state, or another company moves.

Continue Reading

Trending