{"code":"var Component=(()=>{var p=Object.create;var o=Object.defineProperty;var u=Object.getOwnPropertyDescriptor;var m=Object.getOwnPropertyNames;var g=Object.getPrototypeOf,f=Object.prototype.hasOwnProperty;var w=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports),y=(t,e)=>{for(var i in e)o(t,i,{get:e[i],enumerable:!0})},s=(t,e,i,r)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let n of m(e))!f.call(t,n)&&n!==i&&o(t,n,{get:()=>e[n],enumerable:!(r=u(e,n))||r.enumerable});return t};var b=(t,e,i)=>(i=t!=null?p(g(t)):{},s(e||!t||!t.__esModule?o(i,\"default\",{value:t,enumerable:!0}):i,t)),k=t=>s(o({},\"__esModule\",{value:!0}),t);var l=w((A,d)=>{d.exports=_jsx_runtime});var S={};y(S,{default:()=>c});var a=b(l());function h(t){let e={a:\"a\",code:\"code\",em:\"em\",h2:\"h2\",h3:\"h3\",img:\"img\",li:\"li\",ol:\"ol\",p:\"p\",pre:\"pre\",span:\"span\",strong:\"strong\",table:\"table\",tbody:\"tbody\",td:\"td\",th:\"th\",thead:\"thead\",tr:\"tr\",ul:\"ul\",...t.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(e.p,{children:'On 28 September 2026 Apple shipped three Mac updates on the same day: macOS Golden Gate 27.0.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Two of them carry a fix that matters more than the version numbers suggest. The macOS Tahoe 26.7.1 and Sequoia 15.8.1 security notes describe a single CoreGraphics bug, CVE-2026-86950, and Apple says it is aware of a report that the flaw \"may have been exploited in an extremely sophisticated attack against specific targeted individuals.\" The third update, 27.0.1, has no published CVE entries at all. So which of the three do you actually need? That depends on which Mac you own and which macOS it is running today, and the answer for a Mac stuck on Sonoma is uncomfortable. This guide sorts it out model by model, explains what the bug is and what a phrase like \"targeted individuals\" means for an ordinary user, and walks through installing the right update without accidentally jumping to macOS 27.'}),`\n`,(0,a.jsx)(e.p,{children:(0,a.jsx)(e.img,{alt:\"A man in his fifties at a kitchen table in the morning, coffee beside him, looking at a thin silver laptop where a software update is waiting to be installed\",src:\"/images/blog/macos-tahoe-26-7-1-sequoia-15-8-1-zero-day-macos-27-0-1-update-guide-2026/hero.webp\",width:\"1200\",height:\"600\"})}),`\n`,(0,a.jsx)(e.h2,{id:\"key-takeaways\",children:\"Key Takeaways\"}),`\n`,(0,a.jsxs)(e.ul,{children:[`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"Tahoe and Sequoia Macs should install the update now.\"}),\" macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 fix CVE-2026-86950, a CoreGraphics out-of-bounds write that could lead to arbitrary code execution when a maliciously crafted file is processed. Apple's own pages are \",(0,a.jsx)(e.a,{href:\"https://support.apple.com/en-us/149228\",children:\"149228 for Tahoe\"}),\" and \",(0,a.jsx)(e.a,{href:\"https://support.apple.com/en-us/149229\",children:\"149229 for Sequoia\"}),\".\"]}),`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"The exploitation report is about iOS, and it is narrow.\"}),` Apple's wording is that the issue \"may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.\" Apple does not say macOS was attacked, but the same bug was in the macOS code, which is why the fix shipped.`]}),`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"macOS 27.0.1 is a bug-fix release, not a security release.\"}),\" Apple lists it with no published CVE entries. Commentators reading Apple's list report that Golden Gate does not appear to be affected by the CoreGraphics bug.\"]}),`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"Intel Macs and Sonoma Macs are the awkward cases.\"}),\" Intel Macs cannot run macOS 27, so 26.7.1 (four Intel models) or 15.8.1 (the rest) is the only route. Apple published nothing for Sonoma on 28 September; the last Sonoma release on Apple's security page is 14.8.9 from 6 August.\"]}),`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"On a Tahoe Mac, click Update Now next to the 26.7.1 entry, not Upgrade.\"}),\" Software Update on a Tahoe Mac lists both 26.7.1 and 27.0.1, and a careless click or a careless \",(0,a.jsx)(e.code,{children:\"--recommended\"}),\" command can pull you onto macOS 27.\"]}),`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"The 27.0.1 build number is disputed in the press, but Apple's own catalog settles it.\"}),\" 9to5Mac printed 26A5434; the update catalog on a Mac running Tahoe lists it as 26A434, which is what four other sources also report.\"]}),`\n`]}),`\n`,(0,a.jsx)(e.h2,{id:\"what-apple-actually-shipped-on-28-september\",children:\"What Apple Actually Shipped on 28 September\"}),`\n`,(0,a.jsxs)(e.p,{children:[\"Apple's \",(0,a.jsx)(e.a,{href:\"https://support.apple.com/en-us/100100\",children:\"security releases page\"}),\" lists eight items dated 28 September 2026: the 27.0.1 releases for iOS, iPadOS, macOS, watchOS and visionOS, plus iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Of the Mac releases:\"]}),`\n`,(0,a.jsxs)(e.table,{children:[(0,a.jsx)(e.thead,{children:(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.th,{children:\"Release\"}),(0,a.jsx)(e.th,{children:\"What Apple says\"}),(0,a.jsx)(e.th,{children:\"CVE entries\"})]})}),(0,a.jsxs)(e.tbody,{children:[(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:\"macOS Golden Gate 27.0.1\"}),(0,a.jsx)(e.td,{children:\"Bug fixes; one Platform SSO fix in the enterprise notes\"}),(0,a.jsx)(e.td,{children:\"None published\"})]}),(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:\"macOS Tahoe 26.7.1\"}),(0,a.jsx)(e.td,{children:\"CoreGraphics out-of-bounds write\"}),(0,a.jsx)(e.td,{children:\"CVE-2026-86950\"})]}),(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:\"macOS Sequoia 15.8.1\"}),(0,a.jsx)(e.td,{children:\"CoreGraphics out-of-bounds write\"}),(0,a.jsx)(e.td,{children:\"CVE-2026-86950\"})]})]})]}),`\n`,(0,a.jsxs)(e.p,{children:[`The two security entries are word for word the same. Apple's description reads, \"Processing a maliciously crafted file may lead to arbitrary code execution,\" and the fix is described as \"an out-of-bounds write issue was addressed with improved bounds checking.\" The credit goes to Meta Product Security. The same CVE was also fixed in iOS and iPadOS 26.7.1, as `,(0,a.jsx)(e.a,{href:\"https://thehackernews.com/2026/09/apple-patches-coregraphics-flaw.html\",children:\"The Hacker News reported\"}),\" on the day of release.\"]}),`\n`,(0,a.jsxs)(e.p,{children:[\"This was a quick turnaround. The big catch-up releases, Tahoe 26.7 and Sequoia 15.8, had shipped only two weeks earlier on 14 September alongside macOS 27, and we covered the day-one situation in our \",(0,a.jsx)(e.a,{href:\"/blog/macos-27-golden-gate-release-day-update-guide-september-14-2026\",children:\"release-day update guide\"}),\". Apple then put 26.7.1 and 15.8.1 through release candidates; Mac news sites reported a second release candidate for Sequoia 15.8.1 on 21 September. So the fix was in testing for roughly a week before it went public. Nothing on Apple's pages tells us when the underlying attack was first seen, and, as The Hacker News noted, Apple gave no numbers on how many people were targeted or how many attempts succeeded.\"]}),`\n`,(0,a.jsx)(e.h2,{id:\"the-bug-what-coregraphics-does-and-what-an-out-of-bounds-write-means\",children:\"The Bug: What CoreGraphics Does and What an Out-of-Bounds Write Means\"}),`\n`,(0,a.jsx)(e.p,{children:\"CoreGraphics is the drawing framework underneath a large share of what a Mac shows on screen. It renders PDF pages, decodes and draws images, paints vector graphics and handles fonts and colour in a great many apps. Preview, Safari, Mail's message view, Quick Look and third-party editors all call into it, directly or through other system frameworks. That makes it a favourite target: attackers do not need you to install anything, only to get a file in front of code that parses it.\"}),`\n`,(0,a.jsx)(e.p,{children:`An out-of-bounds write is a memory-safety bug. A program allocates a block of memory of a certain size, then, because of a length or index that is not properly checked, writes data past the end of that block. The extra bytes land in whatever memory sits next door. In careful hands that overwrite can be steered to change program state and eventually run code the attacker chose. Apple's summary of the impact, \"arbitrary code execution,\" is the standard phrase for that outcome. The fix is what Apple's description says: add the missing bounds check so the write can no longer leave the buffer.`}),`\n`,(0,a.jsx)(e.p,{children:\"Three limits on what we know:\"}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"Apple has not said how the file arrives.\"}),` The impact line says processing \"a maliciously crafted file.\" It does not say whether that means an image in a message, a PDF, a web page or something else, and it does not say whether the user must open it. One security news site claimed that no additional user interaction might be needed; other coverage does not go that far, and Apple's pages do not say. Treat both claims as unconfirmed.`]}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"Apple has not published a severity score.\"}),\" Aggregators may show a CVSS number, but Apple's security notes do not carry one, so any number you see is a third party's estimate.\"]}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"The exploitation report is tied to iOS.\"}),` Apple's sentence ends with \"on versions of iOS before iOS 27.\" Nothing on the Sequoia or Tahoe pages says that a Mac was attacked. The reasonable reading is that the flawed code exists in the Mac releases too. That is a reading, not something Apple has stated.`]}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.a,{href:\"https://www.helpnetsecurity.com/2026/09/29/apple-core-graphics-zero-day-cve-2026-86950-fixed/\",children:\"Help Net Security\"}),\" noted that iOS 27.0.1, iPadOS 27.0.1 and macOS Golden Gate 27.0.1 shipped with no published CVE-numbered vulnerabilities and do not appear to be affected. That is an inference from Apple's release list, not a statement from Apple, but it is consistent with the fix having been made in the 27 line before release.\"]}),`\n`,(0,a.jsx)(e.h2,{id:\"what-specific-targeted-individuals-means-for-ordinary-users\",children:'What \"Specific Targeted Individuals\" Means for Ordinary Users'}),`\n`,(0,a.jsx)(e.p,{children:\"Apple has used this exact sentence for years about exploited bugs. It describes commercial spyware and similar tools: expensive, tightly controlled, used against journalists, political figures, lawyers, dissidents, executives and others someone has a reason to spy on. The tools are costly to develop and easy to burn, so their operators are careful about who receives them.\"}),`\n`,(0,a.jsx)(e.p,{children:\"That matters for how worried you should be, and it does not matter for whether you should update.\"}),`\n`,(0,a.jsx)(e.p,{children:\"The reasons to relax a little are real. Tools of this kind are not spread through mass phishing, and Apple's wording gives no sign of broad attacks. For a person with no unusual profile, the odds of being hit before the patch were very small.\"}),`\n`,(0,a.jsxs)(e.p,{children:[\"The reasons to update anyway are just as real, and \",(0,a.jsx)(e.a,{href:\"https://tidbits.com/2026/09/28/apple-patches-zero-day-exploit-alongside-september-2026-%EF%A3%BFos-fixes/\",children:\"TidBITS put it plainly\"}),': install the CoreGraphics update within a few days even if you are not a targeted individual. Once Apple publishes the description, even a vague one, the bug is much easier for others to hunt down. TidBITS adds that it is easier now for developers to task an AI with finding it, or a similar bug. The window in which only a handful of actors knew about a flaw closes on the day of the patch, and after that the flaw is an old, documented, fixable problem that every unpatched Mac carries. Also, updating costs you an hour and a restart. Being wrong about \"it will not be me\" can cost much more.']}),`\n`,(0,a.jsx)(e.h3,{id:\"have-i-been-hit-what-you-can-and-cannot-check\",children:\"Have I Been Hit? What You Can and Cannot Check\"}),`\n`,(0,a.jsx)(e.p,{children:\"There is no reliable consumer-level test for this exploit. A patched Mac does not show a log line saying it was compromised beforehand, and anything you find in a forum post claiming to detect it should be treated sceptically. Two practical points instead:\"}),`\n`,(0,a.jsxs)(e.ul,{children:[`\n`,(0,a.jsx)(e.li,{children:\"Apple says it notifies individuals it believes were targeted by mercenary spyware, through the Apple Account. If you have never had such a notification, that is mildly reassuring, but it is not proof.\"}),`\n`,(0,a.jsx)(e.li,{children:\"If you have a specific reason to fear targeting, such as being a journalist, activist or someone in a dispute with a well-resourced party, update, turn on Lockdown Mode (covered below), and contact a digital security organisation rather than trying to forensically inspect the Mac yourself.\"}),`\n`]}),`\n`,(0,a.jsx)(e.h2,{id:\"which-update-does-your-mac-need\",children:\"Which Update Does Your Mac Need?\"}),`\n`,(0,a.jsx)(e.p,{children:\"Two questions decide everything: what macOS is running now, and what is the newest macOS the Mac can run. Apple Menu, then About This Mac, shows both the macOS name and the Mac model. macOS Golden Gate 27 is limited to Apple silicon, so the second question matters mostly for Intel owners.\"}),`\n`,(0,a.jsx)(e.h3,{id:\"by-current-macos\",children:\"By current macOS\"}),`\n`,(0,a.jsxs)(e.table,{children:[(0,a.jsx)(e.thead,{children:(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.th,{children:\"You are running\"}),(0,a.jsx)(e.th,{children:\"Affected by CVE-2026-86950?\"}),(0,a.jsx)(e.th,{children:\"What to install\"}),(0,a.jsx)(e.th,{children:\"Notes\"})]})}),(0,a.jsxs)(e.tbody,{children:[(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:\"macOS Golden Gate 27.0\"}),(0,a.jsx)(e.td,{children:\"Not listed by Apple\"}),(0,a.jsx)(e.td,{children:\"27.0.1 when convenient\"}),(0,a.jsx)(e.td,{children:\"Bug fixes; no CVE entries. Not a security emergency.\"})]}),(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:\"macOS Tahoe 26.x (26.7 or earlier)\"}),(0,a.jsx)(e.td,{children:\"Yes, Apple lists Tahoe\"}),(0,a.jsx)(e.td,{children:\"26.7.1, or upgrade to 27.0.1 if your Mac can\"}),(0,a.jsx)(e.td,{children:\"Both close the exposure.\"})]}),(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:\"macOS Sequoia 15.x (15.8 or earlier)\"}),(0,a.jsx)(e.td,{children:\"Yes, Apple lists Sequoia\"}),(0,a.jsx)(e.td,{children:\"15.8.1, or move to Tahoe or 27 if supported\"}),(0,a.jsx)(e.td,{children:\"Same fix as Tahoe.\"})]}),(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:\"macOS Sonoma 14.x\"}),(0,a.jsx)(e.td,{children:\"Apple has published nothing\"}),(0,a.jsx)(e.td,{children:\"Nothing available for Sonoma\"}),(0,a.jsx)(e.td,{children:\"Move to Sequoia or later.\"})]}),(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:\"macOS Ventura or older\"}),(0,a.jsx)(e.td,{children:\"Apple has published nothing\"}),(0,a.jsx)(e.td,{children:\"Nothing available\"}),(0,a.jsx)(e.td,{children:\"Long out of the patch window.\"})]})]})]}),`\n`,(0,a.jsxs)(e.p,{children:[\"Apple's \",(0,a.jsx)(e.a,{href:\"https://support.apple.com/en-us/100100\",children:\"security releases page\"}),` lists Sonoma 14.8.9 on 6 August 2026 as the newest Sonoma entry, and there is no Sonoma release on 14 or 28 September. Apple's Tahoe and Sequoia pages say \"Availability: macOS Tahoe\" and \"Availability: macOS Sequoia\" respectively and do not mention Sonoma. We do not know whether the bug exists in Sonoma's code. Apple does not say, and it never shipped a fix, so a Sonoma Mac has an unpatched status here in the only sense that matters: no update exists. Our `,(0,a.jsx)(e.a,{href:\"/blog/macos-sonoma-security-updates-ending-september-2026-what-to-do-by-mac-model\",children:\"Sonoma security-updates-ending guide\"}),\" covers what to do, and the short version is that if your Mac can run Sequoia or later, upgrade.\"]}),`\n`,(0,a.jsx)(e.p,{children:(0,a.jsx)(e.img,{alt:\"A woman in a home office holding a notepad and checking the model of an older silver laptop next to a modern one to decide which macOS update each needs\",src:\"/images/blog/macos-tahoe-26-7-1-sequoia-15-8-1-zero-day-macos-27-0-1-update-guide-2026/content-1.webp\",width:\"1200\",height:\"675\"})}),`\n`,(0,a.jsx)(e.h3,{id:\"by-mac-model\",children:\"By Mac model\"}),`\n`,(0,a.jsxs)(e.p,{children:[\"For most people the model settles what is available. Apple's \",(0,a.jsx)(e.a,{href:\"https://support.apple.com/en-us/122867\",children:\"Tahoe compatibility page\"}),\" lists the Macs that can run macOS Tahoe. Among Intel machines only four appear on it:\"]}),`\n`,(0,a.jsxs)(e.ul,{children:[`\n`,(0,a.jsx)(e.li,{children:\"MacBook Pro (16-inch, 2019)\"}),`\n`,(0,a.jsx)(e.li,{children:\"MacBook Pro (13-inch, 2020, Four Thunderbolt 3 ports)\"}),`\n`,(0,a.jsx)(e.li,{children:\"iMac (Retina 5K, 27-inch, 2020)\"}),`\n`,(0,a.jsx)(e.li,{children:\"Mac Pro (2019)\"}),`\n`]}),`\n`,(0,a.jsxs)(e.p,{children:[\"Every other Mac on that page is Apple silicon. Our \",(0,a.jsx)(e.a,{href:\"/blog/macos-27-end-of-intel-mac-era-final-compatibility-list-2026\",children:\"final Intel compatibility list\"}),\" explains the wider picture, and Apple silicon Macs from 2020 onward can run macOS 27 as well.\"]}),`\n`,(0,a.jsxs)(e.table,{children:[(0,a.jsx)(e.thead,{children:(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.th,{children:\"Mac\"}),(0,a.jsx)(e.th,{children:\"Newest macOS it can run\"}),(0,a.jsx)(e.th,{children:\"Your patched target\"})]})}),(0,a.jsxs)(e.tbody,{children:[(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:\"Apple silicon Mac (M1 or later, or the A18 Pro MacBook Neo)\"}),(0,a.jsx)(e.td,{children:\"macOS 27 Golden Gate\"}),(0,a.jsx)(e.td,{children:\"27.0.1, or 26.7.1 if you are staying on Tahoe\"})]}),(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:\"The four Intel Macs above\"}),(0,a.jsx)(e.td,{children:\"macOS Tahoe 26\"}),(0,a.jsx)(e.td,{children:\"26.7.1 (the last macOS for these Macs)\"})]}),(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:\"Other Intel Macs that run Sequoia\"}),(0,a.jsx)(e.td,{children:\"macOS Sequoia 15\"}),(0,a.jsx)(e.td,{children:\"15.8.1\"})]}),(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:\"Intel Macs that stop at Sonoma (2018 and 2019 MacBook Air)\"}),(0,a.jsx)(e.td,{children:\"macOS Sonoma 14\"}),(0,a.jsx)(e.td,{children:\"No fix exists; the Sonoma guide covers your options\"})]})]})]}),`\n`,(0,a.jsx)(e.p,{children:\"For an Intel Mac on Sequoia that could go to Tahoe, there is a small decision: Sequoia 15.8.1 fixes this bug and stays supported for roughly a year, while Tahoe buys about two. That is the arithmetic our Sonoma article laid out, and it still holds. Intel Macs cannot run macOS 27 at all, so Tahoe is their ceiling and each Tahoe security release is the only route to a patched Mac.\"}),`\n`,(0,a.jsx)(e.h3,{id:\"the-apple-silicon-question-stay-on-tahoe-or-move-to-27\",children:\"The Apple silicon question: stay on Tahoe or move to 27?\"}),`\n`,(0,a.jsxs)(e.p,{children:[\"An Apple silicon Mac on Tahoe has a real choice. Both 26.7.1 and macOS 27.0.1 are on offer, and both cover this CVE. The security case for going to 27 is a longer support runway. The case for staying is stability: macOS 27 launched on 14 September, and the first two weeks of any major release produce the most bug reports. If you have work that depends on a specific app, driver or Mission Control setup, there is nothing wrong with taking 26.7.1 now and revisiting 27 later. Our \",(0,a.jsx)(e.a,{href:\"/blog/macos-27-mission-control-spaces-broken-black-screen-fix-2026\",children:\"Mission Control and Spaces problems in macOS 27\"}),\" article lists what people have reported, and it is worth a skim before you jump.\"]}),`\n`,(0,a.jsx)(e.p,{children:\"What you should not do is wait for macOS 27 to feel ready while leaving Tahoe unpatched. Staying on Tahoe means installing 26.7.1.\"}),`\n`,(0,a.jsx)(e.h2,{id:\"what-macos-2701-actually-fixes\",children:\"What macOS 27.0.1 Actually Fixes\"}),`\n`,(0,a.jsxs)(e.p,{children:[`Apple's public wording is thin. The consumer note says the update \"provides bug fixes for your Mac,\" and Apple's own security page for it says only \"no published CVE entries.\" MacRumors, in `,(0,a.jsx)(e.a,{href:\"https://www.macrumors.com/2026/09/28/apple-releases-macos-27-0-1/\",children:\"its release article\"}),\", reported that Apple did not say which bugs were fixed, and quoted one reader complaining about the lack of detail. Beyond that, the useful details come from people who read the enterprise notes and inspect the update:\"]}),`\n`,(0,a.jsxs)(e.ul,{children:[`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"Platform SSO lock-screen fix.\"}),\" \",(0,a.jsx)(e.a,{href:\"https://mrmacintosh.com/macos-tahoe-27-0-1-update-everything-you-need-to-know/\",children:\"Mr. Macintosh\"}),' quotes the enterprise release notes: Apple resolved an issue where \"Platform SSO did not display username and password fields at the Lock Screen after waking from sleep.\" ',(0,a.jsx)(e.a,{href:\"https://eclecticlight.co/2026/09/28/apple-has-just-released-updates-to-golden-gate-27-0-1-26-7-1-and-15-8-1/\",children:\"Howard Oakley's summary\"}),\" agrees that the update fixes unspecified bugs, together with one affecting Platform SingleSignOn.\"]}),`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"Safari 27.0.1.\"}),\" Safari moves to 27.0.1, build 22625.1.29.11.28 per both Mr. Macintosh and Oakley.\"]}),`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"Small app bumps.\"}),\" Oakley reports Passwords at 3.0.1 (the largest change on his list), with minor increments in Mail, Messages and Shortcuts, and updates to system libraries covering Screen Time, the Translation framework, SingleSignOn support, Spotlight's Mail indexer and others. That list is what Oakley found by comparing files, not Apple's changelog.\"]}),`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"Firmware unchanged.\"}),\" The Apple silicon system firmware stays at 20457.1.29, the same as macOS 27.0, per Mr. Macintosh and Oakley.\"]}),`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"Size.\"}),\" Mr. Macintosh gives a delta of about 3.31 GB from 27.0, and Oakley calls it roughly 3.3 GB. A Mac coming from a different starting point may see a different figure, as we show below.\"]}),`\n`]}),`\n`,(0,a.jsx)(e.h3,{id:\"what-this-means-if-you-manage-macs-with-platform-sso\",children:\"What this means if you manage Macs with Platform SSO\"}),`\n`,(0,a.jsx)(e.p,{children:\"If your fleet uses Platform SSO for Macs and users report that the lock screen shows no username and password fields after the Mac wakes from sleep, that is the symptom Apple's enterprise notes describe as fixed in 27.0.1. Test a wake-from-sleep cycle on a pilot Mac, including one left locked overnight, before treating the fix as proven for your identity provider. We could not open a separate Apple enterprise page for 27.0.1, so the wording above is as quoted by Mr. Macintosh.\"}),`\n`,(0,a.jsx)(e.h3,{id:\"what-is-not-fixed-or-not-known\",children:\"What is not fixed, or not known\"}),`\n`,(0,a.jsx)(e.p,{children:\"Do not read 27.0.1 as a fix for the Golden Gate complaints. Apple listed no Mission Control or Spaces fixes, and none for storage growth. A reader comment on MacRumors claimed that Apple Intelligence disk use went up after 27.0.1 even with the features off; that is one anecdote, not something we can confirm. Check your own numbers in Storage settings rather than trusting the anecdote.\"}),`\n`,(0,a.jsx)(e.p,{children:\"Also note the ordering. Apple skipped a public 27.1 beta and went straight to a 27.2 beta, as we noted in the Mission Control article, so 27.0.1 is likely the update you will live with for a few weeks.\"}),`\n`,(0,a.jsx)(e.h2,{id:\"verifying-version-and-build-numbers\",children:\"Verifying Version and Build Numbers\"}),`\n`,(0,a.jsx)(e.p,{children:\"After installing, confirm what you are running. Apple Menu, About This Mac (or System Settings, General, About) shows the macOS version. In Terminal, this prints the version and build directly:\"}),`\n`,(0,a.jsx)(a.Fragment,{children:(0,a.jsx)(e.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,a.jsx)(e.code,{children:(0,a.jsx)(e.span,{className:\"line\",children:(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"sw_vers\"})})})})}),`\n`,(0,a.jsxs)(e.p,{children:[\"Output has three lines: \",(0,a.jsx)(e.code,{children:\"ProductName\"}),\", \",(0,a.jsx)(e.code,{children:\"ProductVersion\"}),\" and \",(0,a.jsx)(e.code,{children:\"BuildVersion\"}),\". For a fuller line, \",(0,a.jsx)(e.code,{children:\"system_profiler SPSoftwareDataType | head -6\"}),' prints \"System Version\" with the version and build in brackets.']}),`\n`,(0,a.jsx)(e.p,{children:\"Here are the numbers we can support, and where each comes from.\"}),`\n`,(0,a.jsxs)(e.table,{children:[(0,a.jsx)(e.thead,{children:(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.th,{children:\"Release\"}),(0,a.jsx)(e.th,{children:\"Version\"}),(0,a.jsx)(e.th,{children:\"Build\"}),(0,a.jsx)(e.th,{children:\"Source and confidence\"})]})}),(0,a.jsxs)(e.tbody,{children:[(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:\"macOS Tahoe\"}),(0,a.jsx)(e.td,{children:\"26.7.1\"}),(0,a.jsx)(e.td,{children:\"25G241\"}),(0,a.jsx)(e.td,{children:\"9to5Mac, iClarified, and the update catalog on a Tahoe Mac (below)\"})]}),(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:\"macOS Sequoia\"}),(0,a.jsx)(e.td,{children:\"15.8.1\"}),(0,a.jsx)(e.td,{children:\"24H32\"}),(0,a.jsx)(e.td,{children:\"iClarified and BetaWiki, reported as the release build; not seen on Apple's own pages\"})]}),(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:\"macOS Golden Gate\"}),(0,a.jsx)(e.td,{children:\"27.0.1\"}),(0,a.jsx)(e.td,{children:\"26A434\"}),(0,a.jsx)(e.td,{children:\"Update catalog, Oakley, Mr. Macintosh, iClarified; 9to5Mac printed 26A5434\"})]})]})]}),`\n`,(0,a.jsx)(e.h3,{id:\"the-disputed-2701-build-number\",children:\"The disputed 27.0.1 build number\"}),`\n`,(0,a.jsx)(e.p,{children:\"9to5Mac's article gives the 27.0.1 build as 26A5434. Mr. Macintosh, Howard Oakley and iClarified all give 26A434, and aggregator sites for Apple's IPSW firmware also list 26A434. Our earlier coverage also recorded macOS 27.0 as build 26A428, which sits naturally next to 26A434.\"}),`\n`,(0,a.jsxs)(e.p,{children:[\"The strongest evidence, though, is Apple's own catalog. We ran \",(0,a.jsx)(e.code,{children:\"softwareupdate --list\"}),\" on a Mac running macOS Tahoe 26.5.2 on 30 September, and it returned, among other items:\"]}),`\n`,(0,a.jsx)(a.Fragment,{children:(0,a.jsx)(e.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,a.jsxs)(e.code,{children:[(0,a.jsxs)(e.span,{className:\"line\",children:[(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\"*\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\" Label: macOS Tahoe 26.7.1-25G241\"})]}),`\n`,(0,a.jsxs)(e.span,{className:\"line\",children:[(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"\tTitle:\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" macOS\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" Tahoe\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" 26.7.1,\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" Version:\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" 26.7.1,\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" Size:\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" 3852999KiB,\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" Recommended:\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" YES,\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" Action:\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" restart,\"})]}),`\n`,(0,a.jsxs)(e.span,{className:\"line\",children:[(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\"*\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\" Label: macOS 27.0.1-26A434\"})]}),`\n`,(0,a.jsxs)(e.span,{className:\"line\",children:[(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"\tTitle:\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" macOS\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" 27.0.1,\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" Version:\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" 27.0.1,\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" Size:\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" 11852702KiB,\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" Recommended:\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" YES,\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" Action:\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" restart,\"})]})]})})}),`\n`,(0,a.jsx)(e.p,{children:\"That is Apple's software update server naming the two builds, and it agrees with 25G241 and 26A434. We would treat 26A5434 as a typo in one article. The point of a build number is to check that your Mac matches, so if yours reads differently, do not assume you are unpatched; check the version number first, and use the build only as confirmation. (The 15.8.1 build, 24H32, is not something we could check on our own Mac, because it is not offered to a Tahoe machine, so it rests on the third-party sources in the table.)\"}),`\n`,(0,a.jsx)(e.h3,{id:\"interpreting-the-size-numbers\",children:\"Interpreting the size numbers\"}),`\n`,(0,a.jsx)(e.p,{children:\"The catalog shows 3,852,999 KiB (about 3.7 GiB) for 26.7.1 and 11,852,702 KiB (about 11.3 GiB) for 27.0.1. The second figure is not a 27.0.1 delta: it appears to be macOS 27 offered as an upgrade to a Mac on Tahoe 26.5.2. Sizes depend on the version you are coming from, so no single number is what you will download.\"}),`\n`,(0,a.jsx)(e.h2,{id:\"how-to-install-each-update\",children:\"How to Install Each Update\"}),`\n`,(0,a.jsx)(e.h3,{id:\"on-a-mac-running-tahoe-or-sequoia\",children:\"On a Mac running Tahoe or Sequoia\"}),`\n`,(0,a.jsxs)(e.p,{children:[\"Open System Settings, click General, then Software Update. A Mac that supports macOS 27 will show two things: the upgrade to macOS 27 and, separately, an update for the version you are on. Apple's \",(0,a.jsx)(e.a,{href:\"https://support.apple.com/en-us/108382\",children:\"update instructions\"}),\" describe the path (General, then Software Update), but do not spell out how to avoid the upgrade. For that, the clearest documentation is \",(0,a.jsx)(e.a,{href:\"https://daringfireball.net/2025/11/software_update_tahoe_confusing\",children:\"Daring Fireball's write-up\"}),` of the Tahoe-era Software Update layout. The panel had an \"Upgrade\" section for the new major version and an \"Other Updates\" section with its own \"Update Now\" button for the current version's update. Gruber's finding was that the \"Update Now\" button in that second section installs the update for your current macOS, not the upgrade, and that the small information button opens a sheet whose pre-ticked boxes have no bearing on what those buttons install. His advice was to click Update Now next to the entry for your own version and to avoid the information button unless you know what you are doing.`]}),`\n`,(0,a.jsx)(e.p,{children:'We are working from that description plus the catalog output above. Apple has changed this screen before, and we have not verified how it looks on every macOS 27 or 26.7 build, so read the screen: the update you want is called \"macOS Tahoe 26.7.1\" or \"macOS Sequoia 15.8.1,\" not \"macOS 27.\" If the button is labelled Upgrade and the name says macOS 27, you are about to do a 12 GB major upgrade, which may be what you want, but should be a decision.'}),`\n`,(0,a.jsx)(e.p,{children:\"Follow the steps:\"}),`\n`,(0,a.jsxs)(e.ol,{children:[`\n`,(0,a.jsx)(e.li,{children:\"Back up first. A point update is low risk, but you are about to restart a machine in the middle of a session.\"}),`\n`,(0,a.jsx)(e.li,{children:`Close important documents. The update will restart the Mac; Apple's catalog lists \"Action: restart\" for both.`}),`\n`,(0,a.jsx)(e.li,{children:\"Click Update Now on the Tahoe or Sequoia entry, and enter your password if asked.\"}),`\n`,(0,a.jsx)(e.li,{children:\"Leave the Mac plugged in. On a MacBook, do not close the lid mid-install.\"}),`\n`,(0,a.jsx)(e.li,{children:\"When it finishes, sign in and check the version as described above.\"}),`\n`]}),`\n`,(0,a.jsx)(e.p,{children:(0,a.jsx)(e.img,{alt:\"A young man in a college dorm room watching a thin silver laptop restart to finish installing a macOS security update, a mug and a backup drive on the desk\",src:\"/images/blog/macos-tahoe-26-7-1-sequoia-15-8-1-zero-day-macos-27-0-1-update-guide-2026/content-2.webp\",width:\"1200\",height:\"800\"})}),`\n`,(0,a.jsx)(e.h3,{id:\"on-a-mac-running-macos-270\",children:\"On a Mac running macOS 27.0\"}),`\n`,(0,a.jsx)(e.p,{children:\"Golden Gate 27.0 users find the 27.0.1 update at System Settings, General, Software Update, as MacRumors' report describes. A restart is required. Since this is a point update within macOS 27 and there is nothing to accidentally upgrade to, the choice is simple.\"}),`\n`,(0,a.jsx)(e.h3,{id:\"from-terminal-with-softwareupdate\",children:\"From Terminal with softwareupdate\"}),`\n`,(0,a.jsxs)(e.p,{children:[\"The command-line tool is useful for scripts, remote sessions and for seeing exactly what will be installed. Everything below comes from the tool's own manual page (\",(0,a.jsx)(e.code,{children:\"man softwareupdate\"}),\") on macOS Tahoe. We have not run an install with these commands on a Mac that was then rebooted for 26.7.1, so treat the install lines as documented syntax with the caveats given.\"]}),`\n`,(0,a.jsx)(a.Fragment,{children:(0,a.jsx)(e.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,a.jsx)(e.code,{children:(0,a.jsxs)(e.span,{className:\"line\",children:[(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"softwareupdate\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" --list\"})]})})})}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.code,{children:\"--list\"}),\" needs no admin rights. It shows each available update with a Label, a Title, a Size, a Recommended flag and an Action. On our Tahoe 26.5.2 Mac the output showed both the 26.7.1 update and the 27.0.1 upgrade as Recommended. That has a direct consequence.\"]}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsxs)(e.strong,{children:[\"Do not blindly run \",(0,a.jsx)(e.code,{children:\"--install --recommended\"}),\".\"]}),\" The manual says \",(0,a.jsx)(e.code,{children:\"--recommended\"}),' installs \"all updates that are recommended for your system.\" On our Mac, macOS 27.0.1 carried \"Recommended: YES,\" so that command could be expected to include the major upgrade. We did not run it to find out; listing first is safer.']}),`\n`,(0,a.jsx)(e.p,{children:\"Install the specific update by its label instead. Copy the label exactly as printed, since Apple builds it from the title and build:\"}),`\n`,(0,a.jsx)(a.Fragment,{children:(0,a.jsx)(e.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,a.jsx)(e.code,{children:(0,a.jsxs)(e.span,{className:\"line\",children:[(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"sudo\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" softwareupdate\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" --install\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:' \"macOS Tahoe 26.7.1-25G241\"'})]})})})}),`\n`,(0,a.jsxs)(e.p,{children:[\"The label above is from our Tahoe catalog listing. For Sequoia, run \",(0,a.jsx)(e.code,{children:\"--list\"}),\" on that Mac and copy the label it shows; we could not see it from a Tahoe machine, so we do not print one. Useful documented flags:\"]}),`\n`,(0,a.jsxs)(e.table,{children:[(0,a.jsx)(e.thead,{children:(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.th,{children:\"Flag\"}),(0,a.jsx)(e.th,{children:\"What the manual says it does\"})]})}),(0,a.jsxs)(e.tbody,{children:[(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:(0,a.jsx)(e.code,{children:\"--list\"})}),(0,a.jsx)(e.td,{children:\"Lists all available updates\"})]}),(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:(0,a.jsx)(e.code,{children:\"--install item\"})}),(0,a.jsx)(e.td,{children:\"Downloads and installs the named update\"})]}),(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:(0,a.jsx)(e.code,{children:\"--download item\"})}),(0,a.jsxs)(e.td,{children:[\"Downloads without installing; later installable through \",(0,a.jsx)(e.code,{children:\"--install\"}),\" or System Settings\"]})]}),(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:(0,a.jsx)(e.code,{children:\"--restart\"})}),(0,a.jsxs)(e.td,{children:[\"Restarts automatically if the install needs it; a logged-in user's apps are quit, and \",(0,a.jsx)(e.code,{children:\"--force\"}),\" adds a forced reboot\"]})]}),(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:(0,a.jsx)(e.code,{children:\"--os-only\"})}),(0,a.jsx)(e.td,{children:\"Only macOS updates\"})]}),(0,a.jsxs)(e.tr,{children:[(0,a.jsx)(e.td,{children:(0,a.jsx)(e.code,{children:\"--safari-only\"})}),(0,a.jsx)(e.td,{children:\"Only Safari updates\"})]}),(0,a.jsxs)(e.tr,{children:[(0,a.jsxs)(e.td,{children:[(0,a.jsx)(e.code,{children:\"--stdinpass\"}),\" and \",(0,a.jsx)(e.code,{children:\"--user\"})]}),(0,a.jsx)(e.td,{children:\"Supply an owner password and an owner user for authorisation; Apple silicon only\"})]})]})]}),`\n`,(0,a.jsx)(e.p,{children:\"The last two apply only to Apple silicon and exist for unattended installs where nobody can type a password. Read the manual before scripting a password into anything.\"}),`\n`,(0,a.jsxs)(e.p,{children:[\"To go the other way, install Safari alone with \",(0,a.jsx)(e.code,{children:\"--safari-only\"}),\" and the macOS update by label. Note that the full installer route in our \",(0,a.jsx)(e.a,{href:\"/blog/macos-27-not-showing-software-update-mac-wont-upgrade-fix-2026\",children:\"Software Update troubleshooting guide\"}),\" uses \",(0,a.jsx)(e.code,{children:\"--fetch-full-installer\"}),\", which is meant for full installers, not for point updates.\"]}),`\n`,(0,a.jsx)(e.h3,{id:\"undoing-it\",children:\"Undoing it\"}),`\n`,(0,a.jsxs)(e.p,{children:[\"There is no undo button for a security update; going back means a Time Machine backup taken before the install or a full reinstall. Apple's Background Security Improvements have their own removal mechanism, explained in our \",(0,a.jsx)(e.a,{href:\"/blog/apple-background-security-improvements-bsi-macos-tahoe-guide-2026\",children:\"BSI guide\"}),\", but 26.7.1 and 15.8.1 are ordinary updates as far as Apple's pages show. Rolling back a fix for a known-exploited bug is rarely wise anyway.\"]}),`\n`,(0,a.jsx)(e.h2,{id:\"managed-macs-deferrals-deadlines-and-the-cisa-listing\",children:\"Managed Macs: Deferrals, Deadlines and the CISA Listing\"}),`\n`,(0,a.jsxs)(e.p,{children:[\"If you administer Macs, the first question is whether a deferral is quietly holding this update back. Two facts from Apple's device-management material, as we set out in our \",(0,a.jsx)(e.a,{href:\"/blog/macos-27-mdm-software-update-commands-removed-tls-requirements-admin-checklist-2026\",children:\"MDM software update commands guide\"}),\", decide how you handle it.\"]}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"On macOS 27, the legacy commands and restrictions do nothing.\"}),' Apple stated that \"legacy software update management no longer functions in all 27.0 operating systems.\" A Mac on 27.0 gets 27.0.1 under declarative management: the ',(0,a.jsx)(e.code,{children:\"com.apple.configuration.softwareupdate.enforcement.specific\"}),\" declaration to require a version by a deadline, and \",(0,a.jsx)(e.code,{children:\"softwareupdate.settings\"}),\" for deferrals and automatic actions.\"]}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"On Tahoe and Sequoia, the situation is different.\"}),\" Those releases predate the removal, so the older mechanisms and the declarative ones can both be in play. If a policy defers minor updates by, say, 30 days, 26.7.1 and 15.8.1 may be held for that period. Check the deferral configuration and the pilot ring before assuming that a fleet is patched. For a known-exploited bug, most administrators will want to shorten the deferral for this one release, or push it with an enforcement deadline.\"]}),`\n`,(0,a.jsxs)(e.ul,{children:[`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"Sonoma and older Macs have no update to push.\"}),\" Plan the OS upgrade, and put such Macs on a watch list rather than a patch list.\"]}),`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"Test Platform SSO on 27.0.1 before pushing it widely.\"}),\" The lock-screen fix is the reason many identity-managed Macs will want the update, so validate wake-from-sleep sign-in on a pilot group first.\"]}),`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"Lockdown Mode blocks configuration profiles.\"}),\" Apple's Lockdown Mode page says configuration profiles cannot be installed while it is on, so enabling it on a managed Mac has consequences for enrolment and profile updates. Decide deliberately.\"]}),`\n`]}),`\n`,(0,a.jsx)(e.h3,{id:\"the-cisa-listing\",children:\"The CISA listing\"}),`\n`,(0,a.jsxs)(e.p,{children:[\"CISA added the flaw to its Known Exploited Vulnerabilities catalog on 29 September. \",(0,a.jsx)(e.a,{href:\"https://www.cisa.gov/news-events/alerts/2026/09/29/cisa-adds-one-known-exploited-vulnerability-catalog\",children:\"CISA's alert\"}),' names it \"Apple Multiple Products Out-of-Bounds Write Vulnerability\" and cites evidence of active exploitation. The remediation deadline of 2 October 2026 for US federal civilian agencies comes from The Hacker News; the CISA alert page we opened refers to Binding Operational Directive 26-04 and does not state a date itself, so check the KEV catalog entry if you need the authoritative deadline. The KEV deadline binds federal agencies, not home users or businesses. It is still a handy yardstick. If a compliance framework you follow treats KEV items as priority patches, this is the cue, and a three-day window is a reasonable internal target for a known-exploited bug on machines that are not exotic.']}),`\n`,(0,a.jsx)(e.h2,{id:\"lockdown-mode-for-higher-risk-users\",children:\"Lockdown Mode for Higher-Risk Users\"}),`\n`,(0,a.jsxs)(e.p,{children:[\"Lockdown Mode is Apple's optional hardening setting. \",(0,a.jsx)(e.a,{href:\"https://support.apple.com/en-us/105120\",children:\"Apple describes it\"}),' as an \"optional, extreme protection\" designed for the very few individuals who, because of who they are or what they do, might be personally targeted by sophisticated cyber threats. It is not meant for everyone, and Apple says so.']}),`\n`,(0,a.jsx)(e.p,{children:\"On a Mac, the path is Apple menu, System Settings, Privacy & Security, Lockdown Mode, then Turn On, and the final step is Turn On & Restart. According to Apple, Lockdown Mode:\"}),`\n`,(0,a.jsxs)(e.ul,{children:[`\n`,(0,a.jsx)(e.li,{children:\"blocks most message attachments other than certain images, video and audio;\"}),`\n`,(0,a.jsx)(e.li,{children:\"turns off some complex web technologies, so some sites load more slowly or break;\"}),`\n`,(0,a.jsx)(e.li,{children:\"blocks incoming FaceTime calls from people you have not contacted in the past 30 days and blocks invitations for Apple services;\"}),`\n`,(0,a.jsx)(e.li,{children:\"strips location information from shared photos;\"}),`\n`,(0,a.jsx)(e.li,{children:\"requires the Mac to be unlocked before connecting a wired accessory;\"}),`\n`,(0,a.jsx)(e.li,{children:\"stops the Mac from joining non-secure Wi-Fi networks automatically;\"}),`\n`,(0,a.jsx)(e.li,{children:\"prevents installation of configuration profiles.\"}),`\n`]}),`\n`,(0,a.jsx)(e.p,{children:\"Two honest caveats. First, Apple has not said whether Lockdown Mode would have blocked this specific exploit, so we cannot claim it would. Second, Lockdown Mode is a reduction of attack surface, not a substitute for the update. Someone at high risk should do both: install 26.7.1 or 15.8.1 first, then consider Lockdown Mode. If you turn it on and find it too restrictive, the same pane turns it off, with another restart.\"}),`\n`,(0,a.jsx)(e.h2,{id:\"troubleshooting-common-issues\",children:\"Troubleshooting Common Issues\"}),`\n`,(0,a.jsx)(e.h3,{id:\"the-update-does-not-appear-in-software-update\",children:\"The update does not appear in Software Update\"}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"Symptoms\"}),': System Settings shows \"Your Mac is up to date,\" or shows only macOS 27, or shows an older number.']}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"Cause\"}),\": Software Update may be showing a cached scan, automatic checking may be off, or a managed deferral may be holding the release. Macs that are not supported by the newest macOS never see it, and Sonoma and older Macs will not see 26.7.1 or 15.8.1 at all because those updates do not apply to them.\"]}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"Solution\"}),\":\"]}),`\n`,(0,a.jsxs)(e.ol,{children:[`\n`,(0,a.jsx)(e.li,{children:\"Confirm your version in About This Mac. Sonoma Macs have no patch.\"}),`\n`,(0,a.jsx)(e.li,{children:\"Restart, then reopen Software Update.\"}),`\n`,(0,a.jsx)(e.li,{children:\"Force a real scan and list the results:\"}),`\n`]}),`\n`,(0,a.jsx)(a.Fragment,{children:(0,a.jsx)(e.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,a.jsxs)(e.code,{children:[(0,a.jsxs)(e.span,{className:\"line\",children:[(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"sudo\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" softwareupdate\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" --background\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" --force\"})]}),`\n`,(0,a.jsxs)(e.span,{className:\"line\",children:[(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"softwareupdate\"}),(0,a.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" --list\"})]})]})})}),`\n`,(0,a.jsxs)(e.ol,{start:\"4\",children:[`\n`,(0,a.jsx)(e.li,{children:\"On a managed Mac, ask your administrator whether an update deferral applies.\"}),`\n`]}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"If that does not work\"}),\": \",(0,a.jsx)(e.code,{children:\"sudo softwareupdate --clear-catalog\"}),\" resets the cached catalogue, which is harmless but rarely the cause. Our \",(0,a.jsx)(e.a,{href:\"/blog/macos-27-not-showing-software-update-mac-wont-upgrade-fix-2026\",children:\"guide to macOS updates that do not show up\"}),\" goes through the remaining causes.\"]}),`\n`,(0,a.jsx)(e.h3,{id:\"the-mac-offered-macos-27-and-i-only-wanted-the-security-update\",children:\"The Mac offered macOS 27 and I only wanted the security update\"}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"Symptoms\"}),\": You clicked the wrong button and a 12 GB download started, or Software Update shows only an Upgrade button.\"]}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"Solution\"}),': Cancel the download from the Software Update pane, and look for the update whose name is \"macOS Tahoe 26.7.1\" or \"macOS Sequoia 15.8.1.\" If it is missing from the screen, ',(0,a.jsx)(e.code,{children:\"softwareupdate --list\"}),\" shows every item, and \",(0,a.jsx)(e.code,{children:\"sudo softwareupdate --install\"}),\" with the label you copied installs just that one. Avoid the information button, which per Daring Fireball can present pre-ticked choices that mislead.\"]}),`\n`,(0,a.jsx)(e.h3,{id:\"the-download-or-install-fails-or-stalls\",children:\"The download or install fails or stalls\"}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"Symptoms\"}),\": An error appears, the progress bar stops, or the update quits after the restart.\"]}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"Cause\"}),\": The usual culprits are low free disk space, an interrupted network connection, a third-party security or VPN tool that interferes, or a stale download.\"]}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"Solution\"}),\":\"]}),`\n`,(0,a.jsxs)(e.ol,{children:[`\n`,(0,a.jsx)(e.li,{children:\"Free at least 20 GB. Point updates unpack files before applying them, and the catalog above reports downloads of around 3.7 GiB for 26.7.1.\"}),`\n`,(0,a.jsx)(e.li,{children:\"Reconnect the network, disable a VPN, and try again.\"}),`\n`,(0,a.jsx)(e.li,{children:\"Delete the partial download in Software Update and download it again.\"}),`\n`,(0,a.jsx)(e.li,{children:\"On a portable Mac, plug in the charger and leave the lid open.\"}),`\n`,(0,a.jsxs)(e.li,{children:[\"Look up the exact code in our \",(0,a.jsx)(e.a,{href:\"/tools/error-codes\",children:\"error code tool\"}),\".\"]}),`\n`]}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"If that does not work\"}),\": Note the Mac's behaviour after the failed restart. A Mac that boots normally has simply failed to apply the update, and retrying is safe. A Mac that will not boot, loops or shows a black screen needs the recovery steps in our \",(0,a.jsx)(e.a,{href:\"/blog/macos-update-went-wrong-mac-wont-boot-recovery-assistant-fix-2026\",children:\"guide to a Mac that will not boot after an update\"}),\".\"]}),`\n`,(0,a.jsx)(e.h3,{id:\"something-broke-after-updating\",children:\"Something broke after updating\"}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"Symptoms\"}),\": An app, VPN or security tool misbehaves after 26.7.1 or 15.8.1.\"]}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"Cause\"}),\": Point updates change system libraries, and CoreGraphics is shared by many apps. Apple lists a single change, so problems are unlikely but not impossible.\"]}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"Solution\"}),\": Restart once, update the affected app to its newest version and check the developer's support page. If you must roll back, restore from a Time Machine backup made before the update, but weigh that carefully: you would be returning to a Mac that has a known-exploited bug.\"]}),`\n`,(0,a.jsx)(e.h3,{id:\"the-mac-is-stuck-on-sonoma-and-can-go-no-further\",children:\"The Mac is stuck on Sonoma and can go no further\"}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"Symptoms\"}),\": Software Update shows nothing new, and the Mac is one of the 2018 or 2019 MacBook Air models.\"]}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"Cause\"}),\": The newest macOS these models can run is Sonoma, and Apple published nothing for Sonoma on 28 September.\"]}),`\n`,(0,a.jsxs)(e.p,{children:[(0,a.jsx)(e.strong,{children:\"Solution\"}),\": Read the stranded-Mac section of our \",(0,a.jsx)(e.a,{href:\"/blog/macos-sonoma-security-updates-ending-september-2026-what-to-do-by-mac-model\",children:\"Sonoma guide\"}),\". Until you replace the Mac, avoid opening unexpected attachments, keep the browser current, and consider using it for low-risk tasks only.\"]}),`\n`,(0,a.jsx)(e.h2,{id:\"faq\",children:\"FAQ\"}),`\n`,(0,a.jsx)(e.h3,{id:\"do-i-need-macos-2671-if-i-already-run-macos-27\",children:\"Do I need macOS 26.7.1 if I already run macOS 27?\"}),`\n`,(0,a.jsx)(e.p,{children:\"No. Apple lists 27.0.1 with no published CVE entries, and the two security entries are for Tahoe and Sequoia. Commentators reading Apple's list say Golden Gate does not appear to be affected. You may still want 27.0.1 for its bug fixes, including the Platform SSO lock-screen fix, but it is not an emergency security update.\"}),`\n`,(0,a.jsx)(e.h3,{id:\"is-cve-2026-86950-being-exploited-on-macs\",children:\"Is CVE-2026-86950 being exploited on Macs?\"}),`\n`,(0,a.jsx)(e.p,{children:\"Apple's wording says the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. It does not say Macs were attacked. The same flaw existed in macOS Tahoe and Sequoia, so Apple fixed those too. CISA lists the CVE as actively exploited, using the label Apple Multiple Products.\"}),`\n`,(0,a.jsx)(e.h3,{id:\"can-i-install-2671-without-upgrading-to-macos-27\",children:\"Can I install 26.7.1 without upgrading to macOS 27?\"}),`\n`,(0,a.jsxs)(e.p,{children:[\"Yes. In System Settings, General, Software Update, choose the Update Now button beside the macOS Tahoe 26.7.1 entry rather than the Upgrade button for macOS 27. From Terminal, run \",(0,a.jsx)(e.code,{children:\"softwareupdate --list\"}),\", then install the 26.7.1 label by name. Avoid \",(0,a.jsx)(e.code,{children:\"--recommended\"}),\", because macOS 27.0.1 was also marked as recommended in our catalog listing.\"]}),`\n`,(0,a.jsx)(e.h3,{id:\"what-is-the-correct-build-number-for-macos-2701\",children:\"What is the correct build number for macOS 27.0.1?\"}),`\n`,(0,a.jsxs)(e.p,{children:[\"We found 26A434. Apple's update catalog, Howard Oakley, Mr. Macintosh and iClarified give that number, while 9to5Mac printed 26A5434, which looks like a typo. Confirm the version number first, 27.0.1, and use the build only as a check. Run \",(0,a.jsx)(e.code,{children:\"sw_vers\"}),\" in Terminal to see both values on your Mac.\"]}),`\n`,(0,a.jsx)(e.h3,{id:\"my-mac-runs-sonoma-is-there-a-fix-for-it\",children:\"My Mac runs Sonoma. Is there a fix for it?\"}),`\n`,(0,a.jsx)(e.p,{children:\"Not from Apple, as of 30 September. The newest Sonoma release on Apple's security page is 14.8.9 from 6 August, and Apple's Tahoe and Sequoia pages do not list Sonoma. If your Mac can run Sequoia or newer, upgrade. If it is a 2018 or 2019 MacBook Air, plan a replacement and reduce risky use.\"}),`\n`,(0,a.jsx)(e.h3,{id:\"should-i-turn-on-lockdown-mode-because-of-this\",children:\"Should I turn on Lockdown Mode because of this?\"}),`\n`,(0,a.jsx)(e.p,{children:\"Only if you are at real risk of targeted attack, such as a journalist, activist or someone facing a well-resourced adversary. Apple designed Lockdown Mode for that small group, and it restricts messages, web features and accessories. Everyone else is better served by installing the update promptly. Lockdown Mode is in System Settings, Privacy & Security, and needs a restart.\"}),`\n`,(0,a.jsx)(e.h3,{id:\"how-big-is-the-update-and-how-long-does-it-take\",children:\"How big is the update and how long does it take?\"}),`\n`,(0,a.jsx)(e.p,{children:\"Sizes vary with your starting version. Our Tahoe 26.5.2 catalog listing showed roughly 3.7 GiB for 26.7.1, while Mr. Macintosh measured about 3.31 GB for the 27.0 to 27.0.1 delta. Plan on a download plus one restart, and expect it to take from about half an hour to somewhat longer on slow connections or older Macs.\"}),`\n`,(0,a.jsx)(e.h2,{id:\"conclusion\",children:\"Conclusion\"}),`\n`,(0,a.jsxs)(e.p,{children:[\"The practical summary fits in a few lines. If your Mac runs Tahoe or Sequoia, install 26.7.1 or 15.8.1 today, choosing the update for your own macOS rather than the macOS 27 upgrade. If you run macOS 27, take 27.0.1 when it suits you; it fixes bugs and a Platform SSO problem, and Apple lists no CVEs for it. If you run Sonoma, there is no patch, and the fix is to move to a newer macOS, which is the subject of our \",(0,a.jsx)(e.a,{href:\"/blog/macos-sonoma-security-updates-ending-september-2026-what-to-do-by-mac-model\",children:\"Sonoma security guide\"}),\".\"]}),`\n`,(0,a.jsxs)(e.p,{children:['\"Specific targeted individuals\" describes who was attacked, not who is at risk once the details are public. A free patch for a documented, actively exploited hole is worth installing the same evening. Before you install, back up and confirm which update you are clicking; afterwards verify the version with ',(0,a.jsx)(e.code,{children:\"sw_vers\"}),\".\"]}),`\n`,(0,a.jsxs)(e.p,{children:[\"If you are unsure which macOS your Mac can run, check our \",(0,a.jsx)(e.a,{href:\"/compatibility\",children:\"compatibility tool\"}),\".\"]}),`\n`,(0,a.jsx)(e.p,{children:(0,a.jsxs)(e.em,{children:[\"Related reading: \",(0,a.jsx)(e.a,{href:\"/blog/macos-sonoma-security-updates-ending-september-2026-what-to-do-by-mac-model\",children:\"Sonoma security updates ending\"}),\", \",(0,a.jsx)(e.a,{href:\"/blog/macos-27-not-showing-software-update-mac-wont-upgrade-fix-2026\",children:\"macOS 27 not showing in Software Update\"}),\", \",(0,a.jsx)(e.a,{href:\"/blog/macos-update-went-wrong-mac-wont-boot-recovery-assistant-fix-2026\",children:\"Mac won't boot after an update\"}),\", \",(0,a.jsx)(e.a,{href:\"/blog/macos-27-mdm-software-update-commands-removed-tls-requirements-admin-checklist-2026\",children:\"MDM software update changes in macOS 27\"})]})})]})}function c(t={}){let{wrapper:e}=t.components||{};return e?(0,a.jsx)(e,{...t,children:(0,a.jsx)(h,{...t})}):h(t)}return k(S);})();\n;return Component;","toc":[{"title":"Key Takeaways","url":"#key-takeaways","depth":2},{"title":"What Apple Actually Shipped on 28 September","url":"#what-apple-actually-shipped-on-28-september","depth":2},{"title":"The Bug: What CoreGraphics Does and What an Out-of-Bounds Write Means","url":"#the-bug-what-coregraphics-does-and-what-an-out-of-bounds-write-means","depth":2},{"title":"What \"Specific Targeted Individuals\" Means for Ordinary Users","url":"#what-specific-targeted-individuals-means-for-ordinary-users","depth":2},{"title":"Have I Been Hit? What You Can and Cannot Check","url":"#have-i-been-hit-what-you-can-and-cannot-check","depth":3},{"title":"Which Update Does Your Mac Need?","url":"#which-update-does-your-mac-need","depth":2},{"title":"By current macOS","url":"#by-current-macos","depth":3},{"title":"By Mac model","url":"#by-mac-model","depth":3},{"title":"The Apple silicon question: stay on Tahoe or move to 27?","url":"#the-apple-silicon-question-stay-on-tahoe-or-move-to-27","depth":3},{"title":"What macOS 27.0.1 Actually Fixes","url":"#what-macos-2701-actually-fixes","depth":2},{"title":"What this means if you manage Macs with Platform SSO","url":"#what-this-means-if-you-manage-macs-with-platform-sso","depth":3},{"title":"What is not fixed, or not known","url":"#what-is-not-fixed-or-not-known","depth":3},{"title":"Verifying Version and Build Numbers","url":"#verifying-version-and-build-numbers","depth":2},{"title":"The disputed 27.0.1 build number","url":"#the-disputed-2701-build-number","depth":3},{"title":"Interpreting the size numbers","url":"#interpreting-the-size-numbers","depth":3},{"title":"How to Install Each Update","url":"#how-to-install-each-update","depth":2},{"title":"On a Mac running Tahoe or Sequoia","url":"#on-a-mac-running-tahoe-or-sequoia","depth":3},{"title":"On a Mac running macOS 27.0","url":"#on-a-mac-running-macos-270","depth":3},{"title":"From Terminal with softwareupdate","url":"#from-terminal-with-softwareupdate","depth":3},{"title":"Undoing it","url":"#undoing-it","depth":3},{"title":"Managed Macs: Deferrals, Deadlines and the CISA Listing","url":"#managed-macs-deferrals-deadlines-and-the-cisa-listing","depth":2},{"title":"The CISA listing","url":"#the-cisa-listing","depth":3},{"title":"Lockdown Mode for Higher-Risk Users","url":"#lockdown-mode-for-higher-risk-users","depth":2},{"title":"Troubleshooting Common Issues","url":"#troubleshooting-common-issues","depth":2},{"title":"The update does not appear in Software Update","url":"#the-update-does-not-appear-in-software-update","depth":3},{"title":"The Mac offered macOS 27 and I only wanted the security update","url":"#the-mac-offered-macos-27-and-i-only-wanted-the-security-update","depth":3},{"title":"The download or install fails or stalls","url":"#the-download-or-install-fails-or-stalls","depth":3},{"title":"Something broke after updating","url":"#something-broke-after-updating","depth":3},{"title":"The Mac is stuck on Sonoma and can go no further","url":"#the-mac-is-stuck-on-sonoma-and-can-go-no-further","depth":3},{"title":"FAQ","url":"#faq","depth":2},{"title":"Do I need macOS 26.7.1 if I already run macOS 27?","url":"#do-i-need-macos-2671-if-i-already-run-macos-27","depth":3},{"title":"Is CVE-2026-86950 being exploited on Macs?","url":"#is-cve-2026-86950-being-exploited-on-macs","depth":3},{"title":"Can I install 26.7.1 without upgrading to macOS 27?","url":"#can-i-install-2671-without-upgrading-to-macos-27","depth":3},{"title":"What is the correct build number for macOS 27.0.1?","url":"#what-is-the-correct-build-number-for-macos-2701","depth":3},{"title":"My Mac runs Sonoma. Is there a fix for it?","url":"#my-mac-runs-sonoma-is-there-a-fix-for-it","depth":3},{"title":"Should I turn on Lockdown Mode because of this?","url":"#should-i-turn-on-lockdown-mode-because-of-this","depth":3},{"title":"How big is the update and how long does it take?","url":"#how-big-is-the-update-and-how-long-does-it-take","depth":3},{"title":"Conclusion","url":"#conclusion","depth":2}],"estimatedTime":31}