MacHabitsOn September 28, Apple released three macOS updates at once: macOS Golden Gate 27.0.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. They are not three versions of the same fix. Which one you need depends on the macOS you run, and if you decided not to upgrade to Golden Gate, the one meant for you is the more urgent.
Which update do you need?
| You run | Install | Why |
|---|---|---|
| macOS 27 Golden Gate, including new Macs that shipped with it | 27.0.1 | Bug fixes. Apple lists no security fixes in it. |
| macOS 26 Tahoe, including every Intel Mac on its last supported version | 26.7.1 | Fixes a CoreGraphics vulnerability Apple says may have been exploited |
| macOS 15 Sequoia | 15.8.1 | Same CoreGraphics fix |
| macOS 14 Sonoma or earlier | No fix available | See below |
To check your version, choose Apple menu > About This Mac.
What the vulnerability is
The fix in 26.7.1 and 15.8.1 addresses CVE-2026-86950, an out-of-bounds write in CoreGraphics, the system framework that draws and processes images, PDFs and other graphics. Opening or previewing a maliciously crafted file could lead to arbitrary code execution. Meta Product Security reported it.
Apple says it is aware of a report that the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. There is no public evidence so far of attacks against Macs, and it was a targeted attack, not a mass campaign. But CoreGraphics handles files that arrive through Mail, Messages, browsers and downloads, so once a flaw like this is public, delaying the patch isn’t worth it.
The Golden Gate 27 branch doesn’t appear to be affected, which is why 27.0.1 has no security entries.
Install the fix without upgrading to Golden Gate
If you’re staying on Tahoe or Sequoia, be careful in Software Update. The big Upgrade Now button installs Golden Gate, not your security update.
- Open System Settings > General > Software Update.
- Look below the Golden Gate upgrade for Other updates are available or More info, and click it.
- Select macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1, and click Install Now.
The update needs a restart. Save your work first, and on a MacBook, plug in.
If your Mac is new
New Macs sold now ship with Golden Gate or offer it during setup. Install 27.0.1 as soon as you finish setting up. If a new Mac came with Tahoe and you intend to keep it there, install 26.7.1 before you start using it for email and browsing.
Check your automatic update settings
In Software Update, click the info button next to Automatic Updates. For the best protection, keep Install Security Responses and system files on. Install macOS updates applies updates within the version you run; major upgrades like Golden Gate still ask first, but read each prompt before clicking.
Managed work Macs follow your IT department’s schedule. If your Mac is managed and still shows an older version, ask IT when the update is going out.
If you’re on Sonoma or older
Apple has released this fix only for Tahoe and Sequoia. Macs on macOS 14 Sonoma or earlier stay exposed to this vulnerability.
- If your Mac can run a newer macOS, upgrade to at least Sequoia and install 15.8.1.
- If it can’t, be careful with files and attachments from people you don’t know, keep Safari and your other apps updated, and start planning to replace the Mac.
The short version
On Golden Gate, install 27.0.1. On Tahoe, install 26.7.1; on Sequoia, 15.8.1. Those two fix a CoreGraphics flaw Apple says may have been exploited in targeted attacks. If you’re avoiding Golden Gate, install the security update from the “Other updates” section of Software Update, not the Upgrade Now button.