Search: “macOS Sequoia”

macOS 27 Golden Gate – Review

Ars Technica reviews macOS 27 Golden Gate, highlighting an unavoidable Apple Intelligence upgrade, new AFM 3 Core models, and dropped Intel Mac support.

macOS 27 Golden Gate delivers the first significant Apple Intelligence upgrade two years after launch, and the toggle to disable the AI features or delete downloaded models is gone. Apple Intelligence runs on a new AFM 3 Core model built in collaboration with Google, while the more capable AFM 3 Core Advanced requires an M3 chip and at least 12GB of RAM. The release drops all Intel Mac support, requiring Apple Silicon, with Sequoia security updates expected to end in fall 2027 and Tahoe's in 2028.

Hacker News · AI·19:53 UTC · 2h agoAI industry 2 sourcesHN 45↑ · 28 comments

Apple security advisory (AV26-930)

CCCS relays Apple's September 14, 2026 security updates fixing vulnerabilities across iOS 27, macOS Tahoe 26.7, Sequoia 15.8, Safari, and other products.

The Canadian Centre for Cyber Security (AV26-930) notes that as of September 14, 2026, Apple has addressed vulnerabilities in iOS and iPadOS prior to 27, macOS Golden Gate prior to 27, macOS Tahoe prior to 26.7, macOS Sequoia prior to 15.8, plus tvOS, watchOS, visionOS 27, Safari, and Xcode prior to 27. The bulletin provides no CVE identifiers or exploitation details. Users and administrators are encouraged to review Apple's security releases and apply the updates.

Canadian Centre for Cyber Security·19:42 UTC · 2h agoAdvisory

CISA Warns of Apple macOS Vulnerability Exploited in Attack (CVE-2026-65400)

CISA added actively exploited macOS flaw CVE-2026-65400 to its KEV catalog, affecting Tahoe, Sequoia, and Sonoma, with a patch deadline of August 21, 2026.

CISA acknowledged active exploitation of CVE-2026-65400, an authentication flaw affecting macOS Tahoe, Sequoia, and Sonoma, and added it to the Known Exploited Vulnerabilities Catalog. The vulnerability was discovered and reported to Apple by Alfredo Pesoli via Bynario Atlas. The remediation deadline is August 21, 2026.

Qualys ThreatPROTECT·Aug 19, 12:34 UTC · 28d agoExploit / PoC in the wildCVE-2026-65400

Apple Rolls Out Massive Security Update Fixing 273 Vulnerabilities Across Its Devices

Apple's coordinated rollout patches 273 unique vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS and Safari, including remote code execution flaws.

Apple shipped one of its largest coordinated security updates on September 14, 2026, fixing 273 unique CVEs across iOS 27, iPadOS 27, macOS Golden Gate 27, watchOS 27, tvOS 27, visionOS 27, Safari 27 and Xcode 27. Highlights include CVE-2026-65414, a Bluetooth out-of-bounds write enabling remote code execution, and CVE-2026-84607, an AVEVideoEncoder race condition granting kernel privileges to sandboxed apps. macOS Golden Gate 27 covers the broadest set with 210 CVEs, and Apple states none of the flaws were exploited in the wild.

Cyber Security News·Sep 15, 15:51 UTC · 1d agoVulnerabilityCVE-2026-65414CVE-2026-84607CVE-2026-64752+7 CVEs1

macOS Screen Sharing Flaw Exploited to Deploy Monero Miners

Dutch NCSC confirms active exploitation of critical macOS Screen Sharing flaw CVE-2026-65400, granting root access and installing Monero miners.

CVE-2026-65400 (CVSS 9.8) is an authentication state-management flaw in macOS's built-in Screen Sharing that lets network attackers authenticate without valid credentials. The Dutch NCSC confirmed active exploitation against systems with port 5900 exposed to the internet; in every documented case attackers obtained root access and installed a Monero cryptocurrency miner. Apple patched the bug in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, crediting Alfredo Pesoli of Bynario. A related researcher scan found roughly 40,000 exposed Screen Sharing hosts, and security firm Calif built working exploits for related flaws in about four hours using an AI coding agent.

Security Affairs·Aug 15, 08:35 UTC · Aug 15, 2026Exploit / PoC in the wildCVE-2026-65400

Apple Updates Everything, (Mon, Sep 14th)

Apple patched a record 261 vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS 27, and other platforms, with none flagged as exploited.

Apple's annual OS update shipped iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27, and visionOS 27 plus bug-fix releases for the 26 and 15 branches, fixing a record 261 vulnerabilities. Notable issues include multiple kernel flaws allowing root privilege escalation (CVE-2026-43689, CVE-2026-43691, CVE-2026-43698, CVE-2026-43786), remote code execution in CUPS (CVE-2026-43692), kernel memory corruption via malicious NFS servers (CVE-2026-43686, CVE-2026-43687), and WebKit memory corruption from crafted web content (CVE-2026-43715). No vulnerabilities are labeled as actively exploited, and Apple does not assign per-CVE severities. Users report iOS 26.7 being downloaded when iOS 27 is intended, and tools like Little Snitch and BlockBlock need updates before upgrading to macOS 27.

SANS Internet Storm Center·Sep 14, 18:33 UTC · 2d agoVulnerabilityCVE-2022-3437CVE-2026-20683CVE-2026-28899+27 CVEs

Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases

Apple patched a record 200+ vulnerabilities in iOS 27 and macOS Golden Gate 27, including 20 kernel flaws; none exploited in the wild.

Apple's iOS 27 and iPadOS 27 releases fix roughly 126 security flaws, 20 of them in the kernel, while macOS Golden Gate 27 addresses 210 vulnerabilities, about 100 shared with the mobile release. macOS Tahoe 26.7 patches 153 unique CVEs, including 26 kernel defects that could cause memory corruption, privilege escalation, system termination, and information leaks. Notable fixes include CVE-2026-64752, a CoreMedia memory corruption flaw allowing iPhone compromise via a malicious image, and CVE-2022-3437, a heap buffer overflow in Heimdal Samba enabling denial-of-service. Apple states none of the patched flaws are known to be exploited in the wild.

SecurityWeek·Sep 15, 11:06 UTC · 1d agoVulnerabilityCVE-2022-3437CVE-2026-647521· 1 read

Attackers exploit patched macOS Screen Sharing flaw to deploy cryptominer

Attackers actively exploit patched macOS Screen Sharing bug CVE-2026-65400 on systems with port 5900 exposed, gaining root to install a Monero cryptominer.

The Netherlands' National Cyber Security Centre (NCSC) reports active exploitation of CVE-2026-65400, an authentication flaw in macOS Screen Sharing that lets attackers authenticate without valid login credentials. Apple patched the issue in macOS Sequoia 15.7.9, Sonoma 14.8.9 and Tahoe 26.6.1, and the NCSC escalated its advisory on August 12 after proof-of-concept code went public and reports arrived of attacks on internet-exposed systems. In every reported case attackers obtained root access and installed a Monero crypto miner; users who cannot patch immediately are advised to disable Screen Sharing.

Help Net Security·Aug 17, 00:00 UTC · Aug 17, 2026Exploit / PoC in the wildCVE-2026-65400

macOS 26.6.2 (25G83)

Apple released macOS 26.6.2 (build 25G83), a point update delivering security patches for Macs on the macOS 26 line.

Apple published macOS 26.6.2 (build 25G83) on August 17, 2026 via its software releases feed. The listing offers downloads and release notes only, without disclosing CVE identifiers or exploitation status. Security-focused point updates for macOS are relevant to enterprise Mac fleets and should be tested and deployed routinely.

Apple software releases·Aug 17, 17:00 UTC · Aug 17, 2026Advisory

Apple macOS Screen Sharing Flaw Exploited on Internet

Actively exploited CVE-2026-65400 in macOS Screen Sharing grants pre-auth root access; attackers deploy Monero miners on exposed systems.

NCSC-NL reported active exploitation of CVE-2026-65400 (CVSS 9.8), an authentication flaw in macOS Screen Sharing patched on August 6, 2026, with root access gained and a Monero miner planted on internet-exposed systems using port 5900. Related Screen Sharing bugs CVE-2026-43779, CVE-2026-43777, and CVE-2026-43760 were fixed in macOS Tahoe 26.6, and researcher @osxreverser noted a pre-auth flaw fixed alongside them affecting roughly 40,000 exposed hosts. Calif said an AI agent produced working exploits for both pre-auth bugs in four hours, underscoring the shrinking gap between patch release and weaponization.

The Hacker News·Aug 19, 05:22 UTC · 28d agoExploit / PoC in the wildCVE-2026-65400CVE-2026-43779CVE-2026-43777+1 CVEs

macOS 27.2 beta (26B5086k)

Apple released macOS 27.2 beta build 26B5086k to developers for testing.

Apple has published macOS 27.2 beta build 26B5086k on its developer release portal with downloads and release notes. The notice contains no security advisories or CVE information.

Apple software releases·17:00 UTC · 5h agoAdvisory

⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply

The Hacker News·Aug 10, 15:03 UTC · Aug 10, 2026Ransomware in the wildCVE-2026-34348CVE-2026-18497CVE-2026-63508+43 CVEs1

macOS 27.0 (26A428)

Apple released macOS 27.0 (build 26A428) with no security fixes detailed in the announcement.

Apple published macOS 27.0 (26A428) on its developer news feed. The notice only links to downloads and release notes without describing security updates. macOS major releases typically include security fixes detailed in separate notes.

Apple software releases·Sep 14, 17:00 UTC · 2d agoAdvisory

macOS 27.0 RC (26A428)

Apple seeded the macOS 27.0 Release Candidate (build 26A428) to developers ahead of the final public release.

Apple published a Release Candidate build of macOS 27.0, labeled 26A428, on its developer release page. The notice only provides download and release-notes links and includes no security content, CVEs, or threat information. RC builds typically precede the general availability of the final operating system version.

Apple software releases·Sep 9, 17:00 UTC · 7d agoAdvisory

U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog

CISA adds actively exploited flaws in Microsoft IKE, SharePoint, VMware vCenter, and macOS Screen Sharing to KEV catalog, due August 21.

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-33824 (Windows IKE remote code execution, CVSS 9.8), CVE-2026-55040 (SharePoint JWT authentication bypass, CVSS 9.1), CVE-2026-59310 (VMware vCenter Syslog path traversal, CVSS 9.8), and CVE-2026-65400 (macOS Screen Sharing improper authentication). The SharePoint flaw combines four weaknesses including alg:none JWT forging to impersonate any user, with Defused researchers observing attackers using Rapid7's PoC against honeypots. The Dutch NCSC confirmed active exploitation of the macOS Screen Sharing flaw on August 15, 2026. Federal agencies must patch by August 21, 2026.

Security Affairs·Aug 19, 07:19 UTC · 28d agoExploit / PoC in the wildCVE-2026-33824CVE-2026-55040CVE-2026-59310+1 CVEs

macOS 27.0 beta 8 (26A5425a)

Apple seeded macOS 27.0 beta 8 (build 26A5425a) to developers with no security fixes disclosed ahead of the final release.

Apple released macOS 27.0 beta 8, build 26A5425a, through its developer program on August 31, 2026. The listing contains only download links and release notes with no vulnerability or CVE information. It is the eighth beta seed in the macOS 27.0 pre-release cycle.

Apple software releases·Aug 31, 17:00 UTC · 16d agoAdvisory

⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.

The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.

The Hacker News·Aug 17, 17:57 UTC · Aug 17, 2026Exploit / PoC in the wildCVE-2026-59310CVE-2026-65400CVE-2026-688201

visionOS 27.0 RC (24M362)

Apple seeded visionOS 27.0 release candidate build 24M362 to developers ahead of the general release.

Apple released the visionOS 27.0 release candidate (build 24M362) through its developer releases feed. The listing only provides downloads and release notes, with no security content or CVE details. RC builds typically precede the public availability of the final OS version.

Apple software releases·Sep 9, 17:00 UTC · 7d agoAdvisory2

tvOS 27.0 (24J361)

Apple released tvOS 27.0 (build 24J361) with no security fixes detailed in the announcement.

Apple published tvOS 27.0 (24J361) on its developer news feed. The notice contains only download and release-note links with no security content described. Any security fixes would be listed in the full release notes.

Apple software releases·Sep 14, 17:00 UTC · 2d agoAdvisory

Switching Password Managers in 2026

An Apple password-management engineer (writing personally) explains switching password managers via iOS direct app-to-app export, crediting FIDO Credential Exchange for passkey portability.

Ricky Mondello, an Apple engineer in password management and authentication (writing personally, not for Apple), demonstrates moving 100 items from 1Password to Apple Passwords via the iOS system export, which transfers passwords, passkeys, verification codes, and notes directly between apps with Face ID confirmation and no intermediate files. He credits the FIDO Alliance's Credential Exchange format (first draft May 2024, now an open spec) and iOS 26/macOS 26 for enabling phishing-resistant credential transfer between apps like 1Password, Bitwarden, Dashlane, DuckDuckGo, and Devolutions. The post is advice rather than news, recommending bulk transfer on the existing device, switching AutoFill to the new app, and treating the new manager as the source of truth.

Lobsters · security·Sep 8, 13:55 UTC · 8d agoIndustry1

tvOS 27.0 RC (24J360)

Apple seeded tvOS 27.0 release candidate build 24J360 to developers ahead of the general release.

Apple released the tvOS 27.0 release candidate (build 24J360) through its developer releases feed. The listing only provides downloads and release notes, with no security content or CVE details. RC builds typically precede the public availability of the final OS version.

Apple software releases·Sep 9, 17:00 UTC · 7d agoAdvisory

MacOS 27 - First Boot, (Tue, Sep 15th)

SANS ISC documents the expected network traffic macOS 27 'Golden Gate' generates on first boot to help defenders baseline their networks.

Johannes Ullrich of SANS Internet Storm Center captured roughly 300 packets from a macOS 27 'Golden Gate' system before user login, covering DHCP, IPv6 duplicate address discovery, DNS, and TCP behavior. macOS 27 resolves hostnames like albert.apple.com (device activation, certificate-pinned), push messaging hosts, and ipv4only.arpa for NAT64 networks. The OS still uses a TCP window scale of 6, ECN, and random timestamps, with only four TCP connections observed during boot. The analysis provides a reference baseline for security teams monitoring Apple endpoints.

SANS Internet Storm Center·Sep 15, 15:23 UTC · 1d agoResearch

visionOS 27.0 (24M362)

Apple ships visionOS 27.0 (build 24M362) for Vision Pro; release notice contains no security or CVE details.

Apple announced the general availability of visionOS 27.0, build 24M362, via its developer release feed. The notice contains only download and release-notes links with no vulnerability or CVE information. Defenders should consult the security release notes to determine if patches affect Apple Vision Pro devices.

Apple software releases·Sep 14, 17:00 UTC · 2d agoAdvisory

watchOS 27.0 RC (24R363)

Apple seeded watchOS 27.0 release candidate build 24R363 to developers ahead of the general release.

Apple released the watchOS 27.0 release candidate (build 24R363) through its developer releases feed. The listing only provides downloads and release notes, with no security content or CVE details. RC builds typically precede the public availability of the final OS version.

Apple software releases·Sep 9, 17:00 UTC · 7d agoAdvisory

tvOS 27.0 beta 8 (24J5360a)

Apple seeded tvOS 27.0 beta 8 (build 24J5360a) to developers as the annual fall OS release cycle approaches final builds.

Apple released the eighth beta of tvOS 27.0, build 24J5360a, through its developer program on August 31, 2026. The listing contains only download links and release notes with no disclosed security fixes or CVEs. Beta 8 indicates the pre-release cycle is nearing the stable 27.0 rollout.

Apple software releases·Aug 31, 17:00 UTC · 16d agoAdvisory

tvOS 27.2 beta (24K5088l)

Apple seeded tvOS 27.2 beta build 24K5088l to developers with no security details disclosed in the release listing.

Apple released tvOS 27.2 beta (build 24K5088l) to developers on September 16, 2026, per its software release listing. The listing contains only download links and a pointer to release notes, with no security content or vulnerability details. It is a routine developer beta with no reported exploitable issues.

Apple software releases·17:00 UTC · 5h agoAdvisory

MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer

Huntress dissects MacSync Stealer, a macOS infostealer delivered through fake Claude Code download pages in Google search results.

Huntress SOC analysts published a reverse-engineering analysis of MacSync Stealer, a macOS infostealer distributed through fraudulent Claude Code download pages surfaced via web searches. Users searching for Anthropic's Claude coding tool are redirected to fake download pages that install the stealer, abusing developer trust in popular AI tooling. The writeup covers the analysis of the sample and its delivery chain.

Huntress·Aug 17, 04:00 UTC · Aug 17, 2026Malware in the wild

The Apple Security Update Review for September 2026

Apple's September 2026 updates patch 45+ flaws, including a 9.8 Screen Sharing authentication bypass (CVE-2026-65400) already listed in CISA's KEV.

ZDI's review of Apple's September 2026 security updates catalogs dozens of CVEs across macOS, iOS, iPadOS, watchOS and other platforms. CVE-2026-65400 (CVSS 9.8) lets a network attacker authenticate to Screen Sharing Server without valid credentials and is flagged as KEV, while CVE-2026-65414 (CVSS 9.8) enables remote code execution via Bluetooth. The set also includes 8.8-rated memory corruption flaws in WebKit, WebRTC, CUPS, ImageIO and the kernel, plus sandbox escapes, privilege escalations to root, and arbitrary code execution via crafted files.

Zero Day Initiative Blog·19:58 UTC · 2h agoVulnerability in the wildCVE-2026-65400CVE-2026-65414CVE-2026-43692+27 CVEs

iPadOS 26.6.1 (23G83)

Apple released iPadOS 26.6.1 (build 23G83), a maintenance update applying security fixes to iPads on the iPadOS 26 line.

Apple listed iPadOS 26.6.1 (build 23G83) on August 17, 2026. The release entry contains only download links and release notes, with no CVE identifiers or exploitation details in the announcement. The matching build number with iOS 26.6.1 indicates shared core components updated in tandem across Apple platforms.

Apple software releases·Aug 17, 17:00 UTC · Aug 17, 2026Advisory

visionOS 27.2 beta (24N5088l)

Apple seeded visionOS 27.2 beta build 24N5088l to developers with no security details disclosed in the release listing.

Apple released visionOS 27.2 beta (build 24N5088l) to developers on September 16, 2026, per its software release listing. The listing contains only download links and a pointer to release notes, with no security content or vulnerability details. It is a routine developer beta with no reported exploitable issues.

Apple software releases·17:00 UTC · 5h agoAdvisory

HP Easy Start for macOS: CVE-2026-12554 / CVE-2026-12555 / CVE-2026-12556

Cipher Security Labs disclosed three high-severity macOS privilege vulnerabilities in HP Easy Start, fixed in version 2.16.7.260722.

HP Easy Start for macOS contains three high-severity vulnerabilities, CVE-2026-12554, CVE-2026-12555, and CVE-2026-12556, that break the product's macOS privilege boundaries. The issues were researched by Cipher Security Labs and coordinated with HP under advisory HPSBPI04124. Fixes are available in HP Easy Start 2.16.7.260722 and later versions.

Full Disclosure·Sep 4, 00:13 UTC · 12d agoVulnerabilityCVE-2026-12554CVE-2026-12555CVE-2026-12556

visionOS 26.6.1 (23O780)

Apple shipped visionOS 26.6.1 (build 23O780), a security and maintenance update for Vision Pro headsets.

Apple listed the visionOS 26.6.1 release (build 23O780) on August 17, 2026. The announcement contains only download and release note links, with no CVE identifiers or exploitation details disclosed in the feed text. Updates to visionOS generally bundle security patches alongside functional improvements for Apple Vision Pro.

Apple software releases·Aug 17, 17:00 UTC · Aug 17, 2026Advisory

iPadOS 27.0 (24A437)

Apple released iPadOS 27.0 (build 24A437) with no security fixes detailed in the announcement.

Apple published iPadOS 27.0 (24A437) on its developer news feed. The notice only links to downloads and release notes without describing security updates. Security content should be verified in the full release notes.

Apple software releases·Sep 14, 17:00 UTC · 2d agoAdvisory 3 sources

watchOS 27.0 (24R364)

Apple released watchOS 27.0 (build 24R364) with no security fixes detailed in the announcement.

Apple published watchOS 27.0 (24R364) on its developer news feed. The notice contains only download and release-note links with no security content described. Defenders should check the release notes for any security fixes.

Apple software releases·Sep 14, 17:00 UTC · 2d agoAdvisory