X-twitter Facebook-f Pinterest-p
X-twitter Facebook-f Pinterest-p

I found the best Prime Day headphone deals worth your money, and skipped the noisy junk


I don’t trust most Prime Day headphone deals at first glance. Too many lean on inflated list prices, vague “limited-time” banners, or brands you’ll never think about again after checkout. The five below have clearer reasons to buy: proven names, useful price drops, and enough review context to avoid gambling on mystery cans.

Sony WH-1000XM5 – the safest premium ANC buy

Sony

At $198, the Sony WH-1000XM5 is the easiest deal to recommend first. It’s down from $399.99, which puts one of Sony’s best-known noise-canceling headphones at 50% off. When we tested the XM5, it held up where most shoppers actually care: sound quality, comfort, call clarity, noise canceling, and battery life. That tracks with Amazon’s user base, where it has a 4.2-star average from more than 19,000 reviews. The main compromise is portability, since these fold flat but don’t fold up like the older XM4.

In case you need a stronger nudge, here’s a quick list of the ups and downs to help you make an informed decision:

Pros

  • Excellent sound
  • Very good comfort
  • Ultra-clear call quality
  • Excellent noise canceling
  • Very good battery life
  • Hi-res compatible (wired/wireless)
  • Hands-free voice assistant access

Cons

  • Fold-flat, but don’t fold up
  • No Auracast support
  • Hinge may break under stress

And here’s the final verdict for you: “At $400, Sony’s best noise-canceling headphones cost the same or less than newer models from Bose, Apple, Sonos, and JBL. Their advanced age means they lack a few features we’ve started to get used to, like spatial audio, USB Audio, and support for Auracast, and they’re all things we’d like to see in the WH-1000XM6.

But despite these omissions, the WH-1000XM5 remain the best all-around noise-cancelling cans for most people. Because when it comes to sound quality, comfort, call quality, ANC, and battery life — the essential ingredients we want from these devices — the XM5 are still outstanding.”

Bose QuietComfort Ultra Headphones – the ANC splurge

Body Part, Face, Head
Bose

Start with Bose if silence is the whole point. Prime members can get the QuietComfort Ultra Headphones for $269, down from $449, which is 40% off.

Bose earns the premium here with best-in-class noise canceling, excellent comfort, natural transparency, impressive spatial audio, and hi-res compatibility. I’d put these near the top for flights, office chatter, and people who treat speakerphone calls like a public service. One annoyance worth knowing: ANC can’t be fully turned off, and some colors cost more. Want a clearer picture? Here you go:

Pros

  • Premium materials and design
  • Excellent comfort
  • Best-in-class noise canceling
  • Natural-sounding transparency
  • Impressive spatial audio
  • Hi-res compatibility

Cons

  • Tricky volume control
  • ANC can’t be turned off

Sennheiser Momentum 4 Wireless – the sound-first pick

Adult, Female, Person
Sennheiser

Go for the Sennheiser Momentum 4 Wireless if sound quality and battery life matter more to you than owning the trendiest pair. Prime members can get it for $189, down from $299.99.

In testing, the Momentum 4 made its case with outstanding sound, huge battery life, comfortable wear, effective ANC, and strong wind-noise reduction. The 60-hour battery life is still the headline spec, especially if you hate charging headphones every few days. Sony and Bose remain safer bets for maximum noise cancellation, but Sennheiser is the better fit for long listening sessions.

Here’s a more detailed overview of the testing verdict: “Bose, like Apple, seems to believe that no one really needs their wireless headphones to last more than about 20 to 24 hours between charges, and maybe it’s right. But given that companies like Sennheiser and Sony have proven that far more juice than that can be packed into a set of wireless cans (up to 60 hours in the case of the Sennheiser Momentum 4 Wireless), it’s a bit difficult to commend the QC Ultra for their 24-hour stamina — a number that drops to 18 hours when using immersive audio and ANC — especially when there’s no longer an option to extend that time by disabling both modes.”

JBL Live 770NC – the best $100 value play

Person, Face, Happy
JBL

At $99.95, the JBL Live 770NC is the “I need good headphones, not a financial event” deal. It’s down from $199.95, which makes it 50% off.

JBL packed this thing properly for the price. In our CES coverage, we noted the Live 770NC’s 40mm drivers, Bluetooth 5.3, True Adaptive Noise Canceling, Smart Ambient, Personi-Fi 2.0, JBL Spatial Sound, multipoint, and up to 65 hours of battery life with ANC off. It also has a 4.6-star average from more than 2,100 Amazon reviews. At this price, the compromise is predictable: it won’t hush the world like Bose.

Beats Studio Pro – the Apple-friendly pick under $150

A woman wears Beats Studio Pro wireless headphones.
Beats

The Beats Studio Pro makes the most sense if you want slick headphones that play nicely with Apple and Android without spending AirPods Max money. Amazon lists them at $149.95, down from the $199.95 typical price.

We liked the Studio Pro’s clean design, secure fit, clear and balanced sound, head-tracked spatial audio, lossless USB audio, and simple controls. You also get ANC, transparency mode, broad device compatibility, and up to 40 hours of battery life. Just know what you’re giving up: there’s no Bluetooth multipoint, no wear sensors, and head tracking doesn’t work on Android.



Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

The Japanese SUV that retains value better than German rivals

Europol Disrupts StealC and Amadey Malware Infrastructure in Operation Endgame

Why Frontier AI makes prioritization the most important part of your CTEM program

Cisco Unified CM Flaw CVE-2026-20230 Actively Exploited in the Wild

Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Europol Disrupts StealC and Amadey Malware Infrastructure in Operation Endgame

Why Frontier AI makes prioritization the most important part of your CTEM program

Cisco Unified CM Flaw CVE-2026-20230 Actively Exploited in the Wild

5 Samsung DeX features I wish someone had told me about sooner

Europol Disrupts StealC and Amadey Malware Infrastructure in Operation Endgame

Why Frontier AI makes prioritization the most important part of your CTEM program

Cisco Unified CM Flaw CVE-2026-20230 Actively Exploited in the Wild

Recent Reviews

Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites


Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Pierluigi Paganini
May 25, 2026

Threat actors are actively exploiting a security flaw, tracked as CVE-2026-26980, in Ghost CMS that was fixed months ago in real attacks against unpatched websites. According to Qianxin, the campaign has already affected more than 700 sites, including well-known organizations and universities.

The vulnerability is an SQL injection issue in Ghost’s Content API that can let an attacker read data from the database without logging in. In the worst case, this can expose the Admin API key, which can allow attackers to take over the site.

That key matters because it can be used to change published content. In this campaign, attackers used it to edit articles on compromised Ghost sites and insert malicious JavaScript at the end of pages. The goal was not just defacement, but to turn trusted websites into launch points for further malware delivery.

“After an in-depth investigation and analysis, we determined that this was not a targeted intrusion against the customer, but rather a large-scale poisoning campaign by an in-the-wild attack group targeting Ghost CMS. Although CVE-2026-26980 was publicly disclosed as early as February 19, a large number of users did not patch and upgrade in time, providing an opportunity for attackers.” reads the advisory published by Qianxin. “At least two groups are currently actively conducting such poisoning operations, and some sites have even become the target of competition between the two parties, with different malicious code being implanted one after another within a single day.”

The inserted code led visitors through a two-step chain. First, the page loaded a remote script that checked the browser and decided what the visitor should see. Then real victims were redirected to a fake verification page that looked like a normal “I’m human” check.

This is where the ClickFix part began. The page told users to press Windows+R, paste a command, and hit Enter. In practice, that command downloaded and started a malware payload on the victim’s machine. It was a classic social engineering trick: make the user do the dangerous part themselves.

Qianxin says the first signs of this activity appeared in early May. The malicious code found in the campaign had a compilation date of February 16, the same day Ghost announced the fix for CVE-2026-26980. That suggests the attackers moved quickly once they saw how many sites had not been updated.

The affected websites cover a wide range of sectors. Roughly half are personal blogs or independent sites, but the list also includes technology blogs, AI sites, media outlets, crypto projects, and educational institutions. Qianxin researchers say victims include sites linked to Harvard, Oxford, and DuckDuckGo.

The attack chain was also designed to be flexible. The loaders could fetch different payloads depending on the target, and the operators changed infrastructure several times.

“entire attack process has obvious five-stage characteristics of “CMS Takeover → Page Poisoning → Two-stage Loading → Social Engineering Lure (FakeCaptcha/ClickFix) → Malware Delivery”, and the entire process is highly automated: bulk vulnerability scanning → automatic key extraction → bulk injection → dynamic C2 distribution.” states the report.

In some cases, they switched domains after detection, keeping the campaign alive even when part of the chain was blocked.

“Through feature scanning of publicly accessible pages, we have cumulatively identified more than 700 poisoned victim domains, and have proactively contacted the sites for which contact information could be obtained, notifying them of the poisoning.” continues the report.

Qianxin also believes at least two different groups are involved. In some cases, the same site was hit more than once, with one attacker replacing the code left by another. That makes the campaign harder to clean up and shows how attractive compromised Ghost sites have become for abuse.

For site owners, the advice is straightforward. Ghost should be updated immediately, all credentials should be rotated, and site logs should be reviewed for suspicious admin API activity. Any injected scripts should be removed from the database itself, not just from the visual editor. Visitors who may have reached a poisoned site should also be warned.

The report includes Indicators of Compromise (IoCs) for the attacks observed by the researchers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ghost CMS)





Source link

Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Third-Party Cyberattack Impacts Patient Information at The Oncology Institute

Lazarus APT unveils fileless RAT designed to evade detection

Copyright © 2024 All Rights Reserved.