Should you update to macOS Golden Gate 27?
No: install macOS Golden Gate 27.2 instead. macOS Golden Gate 27 is a security update Apple released on 14 Sep 2026 for Mac. It fixes 276 security flaws.[1] One of them is already being used in attacks.
It has since been replaced by macOS Golden Gate 27.2, released 26 Oct 2026, which includes all of its fixes. If you’re on an older version, install that instead.
Should you update?
No: install macOS Golden Gate 27.2 instead. macOS Golden Gate 27.2 came out on 26 Oct 2026 and includes every fix in macOS Golden Gate 27, so there’s no reason to stop at this one. Software Update offers the newest version your Mac can run.
Is macOS Golden Gate 27 still safe?
Not any more. macOS Golden Gate 27.2 fixes 262 security flaws that macOS Golden Gate 27 doesn’t, and each became public the day its fix shipped. Installing it is safe: get it only from System Settings → General → Software Update, never from a link in an email, text or pop-up.
What it fixes
Apple lists 276 security flaws across 119 parts of macOS. For each, Apple says what an attacker could have done before the fix.[1]
| Part | Flaws | What an attacker could do |
|---|---|---|
| Kernel | 38 | Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory |
| CUPS | 11 | An app may be able to cause unexpected system termination |
| SMB | 10 | A local user may be able to read kernel memory |
| ImageIO | 8 | Processing a maliciously crafted image may lead to a denial-of-service |
| SceneKit | 8 | Processing a maliciously crafted 3D file may lead to an out-of-bounds read |
| Security | 6 | An attacker in a privileged network position may be able to intercept network traffic |
| Apple Neural Engine | 5 | An app may be able to cause unexpected system termination |
| Bluetooth | 5 | A remote attacker may be able to cause unexpected app termination or arbitrary code execution |
| CoreMedia | 5 | An app may be able to access user-sensitive data |
| CoreUI | 5 | Processing a maliciously crafted file may lead to unexpected app termination |
| Disk Images | 5 | Processing a maliciously crafted disk image may lead to unexpected app termination |
| Heimdal | 5 | An attacker in a privileged network position may be able to modify network traffic |
| Sandbox | 5 | An app may be able to access protected user data |
| Siri | 5 | An app may be able to access sensitive user data |
| Foundation | 4 | An app may be able to access sensitive user data |
| 104 other parts | 151 |
Used in attacks
This fix closes a flaw that attackers were already using before the update came out, either on CISA’s list of flaws being used in attacks or in Apple’s own words.[2]
How to update, and how long it takes
It takes 15 to 45 minutes in all: a few minutes to download, then it prepares, installs and restarts, and you can’t use the Mac while it installs.
- Back up first if you can.iCloud backup or your computer. Updates rarely go wrong, but a backup makes it painless if one does.
- Open Apple menu → System Settings → General → Software Update.Your Mac shows the newest version it can run. Tap or click Update Now, or Upgrade Now for a new major version.
- Leave it plugged in.It downloads, prepares and restarts. Expect 15 to 45 minutes.
- Turn on automatic updates.In the same place, under Automatic Updates, turn on both downloading and installing security responses and updates.
To check it worked: Apple menu → About This Mac shows the macOS name and version. It should say Golden Gate 27.2 or later.
Older devices
The same day, Apple released macOS Tahoe 26.7 (178 security flaws) and macOS Sequoia 15.8 (180 security flaws) for Macs that stay on an older version. Each fixes the same holes where they apply.
Before and after
- After: macOS Golden Gate 27.2, 26 Oct 2026, 263 security flaws
- macOS updates, every release and the latest version
- Updates, the latest version of everything HARD tracks
References
- ^ Apple. “About the security content of macOS Golden Gate 27”, 14 Sep 2026.
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”.