Apple released macOS 27.0 (build 26A428) with no security fixes detailed in the announcement.
Apple published macOS 27.0 (26A428) on its developer news feed. The notice only links to downloads and release notes without describing security updates. macOS major releases typically include security fixes detailed in separate notes.
Apple seeded the macOS 27.0 Release Candidate (build 26A428) to developers ahead of the final public release.
Apple published a Release Candidate build of macOS 27.0, labeled 26A428, on its developer release page. The notice only provides download and release-notes links and includes no security content, CVEs, or threat information. RC builds typically precede the general availability of the final operating system version.
Apple seeded macOS 27.0 beta 8 (build 26A5425a) to developers with no security fixes disclosed ahead of the final release.
Apple released macOS 27.0 beta 8, build 26A5425a, through its developer program on August 31, 2026. The listing contains only download links and release notes with no vulnerability or CVE information. It is the eighth beta seed in the macOS 27.0 pre-release cycle.
SANS ISC documents the expected network traffic macOS 27 'Golden Gate' generates on first boot to help defenders baseline their networks.
Johannes Ullrich of SANS Internet Storm Center captured roughly 300 packets from a macOS 27 'Golden Gate' system before user login, covering DHCP, IPv6 duplicate address discovery, DNS, and TCP behavior. macOS 27 resolves hostnames like albert.apple.com (device activation, certificate-pinned), push messaging hosts, and ipv4only.arpa for NAT64 networks. The OS still uses a TCP window scale of 6, ECN, and random timestamps, with only four TCP connections observed during boot. The analysis provides a reference baseline for security teams monitoring Apple endpoints.