macOS: security updates for Macs used as servers or build machines

Updated November 2026

Apple fixes the most security problems in the newest macOS. As of November 2026, Apple still ships security updates for macOS Golden Gate 27, Tahoe 26 and Sequoia 15, but the two older versions do not get every fix. On a headless Mac, list updates with softwareupdate -l, install them with sudo softwareupdate -i -a -R, and update Homebrew packages separately.

Which macOS versions get fixes

Apple publishes no end-of-life dates for macOS. The pattern on its security releases page is clear, though: each update round covers the current version and the two before it.

macOS security updates (as of November 2026)
Version	Latest security release	Status
macOS Golden Gate 27	27.2, October 26, 2026	Current; gets all fixes
macOS Tahoe 26	26.7.2, October 26, 2026	Security updates; last version for Intel Macs
macOS Sequoia 15	15.8.2, October 26, 2026	Security updates
macOS Sonoma 14	14.8.9, August 6, 2026	No update since Golden Gate 27 came out on September 14, 2026; treat as end of life

Apple's deployment guide says plainly that "not all known security issues are addressed in previous versions". Only the newest major version is fully patched. Apple sometimes ships a one-off update for a much older version (macOS Big Sur 11.7.11 in February 2026, for example), but do not plan around it.

Intel Macs. macOS Golden Gate 27 runs only on Macs with Apple silicon. An Intel Mac stops at Tahoe 26 and will lose security updates when Tahoe drops out of the supported set. Apple has not announced when.

Check the version and pending updates

sw_vers
softwareupdate -l
softwareupdate --history

sw_vers prints the macOS version and build. softwareupdate -l (no admin rights needed) lists the available updates and shows which ones need a restart. --history shows what was installed and when.

Install updates now

Install everything that is offered, restarting if needed (this reboots the Mac):

sudo softwareupdate -i -a -R

-a installs all applicable updates and -R restarts automatically when an update requires it; without -R you must restart yourself before the fix takes effect. Other useful options:

--os-only installs only macOS updates; --safari-only only Safari.
To install one item, give its label from the -l list: sudo softwareupdate -i "Label from the list". Do this if you want to stay on your current major version and the list also offers an upgrade.
--download fetches updates without installing them, so the maintenance window is shorter.

On Apple silicon, installing needs the approval of an owner user of the Mac. For unattended runs, softwareupdate accepts --user and --stdinpass (the password read from standard input). Keep that password out of scripts and logs; on managed fleets, use device management (MDM) instead, as described below.

Command Line Tools for Xcode also appear in softwareupdate -l. Xcode itself has its own entries on Apple's security releases page (Xcode 27.2 on October 29, 2026), so update build machines' Xcode too.

Background Security Improvements

Since macOS 26.1, Apple can ship small security fixes between regular updates, called Background Security Improvements. They have letters after the version: for example, macOS 26.3.1 (a) fixed a WebKit flaw (CVE-2026-20643) on March 17, 2026. Key points:

They are on when Automatically Install is on in System Settings > Privacy & Security > Background Security Improvements. If you turn it off, the Mac gets the fixes only in a later regular update.
They come only for the latest versions of macOS, and only when the Mac starts up from its built-in storage. A build machine booted from an external disk misses them.
Improvements that touch the operating system need a restart. A Safari-only fix may need just a Safari relaunch, but a restart makes it available to the rest of the system.
You can remove an improvement; the Mac then goes back to the base update.

Older macOS versions (from Ventura 13) had a similar mechanism called Rapid Security Responses, such as macOS Ventura 13.4.1 (a) and (c) in July 2023. Apple's current pages describe only Background Security Improvements.

Automatic updates

On a single Mac, turn on automatic updates in System Settings > General > Software Update. Automatic downloads only happen while the Mac is on power, which is normally true for a server or build machine. A Mac that must not reboot during builds still needs a regular restart window; schedule one.

For several Macs, use an MDM service. Apple's declarative device management lets you set automatic update behavior, delay updates by 1 to 90 days for testing, and enforce a specific update by a deadline. At the deadline macOS force quits open apps and restarts if needed. If a Mac misses the deadline, it installs the update when it is next online.

Homebrew packages

softwareupdate does not touch Homebrew. On build machines, Homebrew often supplies OpenSSL, Git, language runtimes and databases. Update them as the user that owns the Homebrew installation, not with sudo:

brew update
brew outdated
brew upgrade

brew update fetches the newest Homebrew and formula definitions, brew outdated lists what has newer versions and brew upgrade installs them. Pinned formulae (brew pin) are skipped, so check your pins after a security release. Services started by Homebrew keep running old code until restarted (this briefly stops the service):

brew services restart nginx

Homebrew fully supports (Tier 1) macOS Golden Gate 27, Tahoe 26 and Sequoia 15 on Apple silicon. Intel Macs are Tier 3; Homebrew has stopped building new binary packages for Intel and plans to stop running on Intel in or after September 2027. Run the update from a scheduled job and alert on failures.

Where advisories are published

Apple security releases: support.apple.com/en-us/100100 lists every update and Background Security Improvement, each with a page of fixed CVEs. Apple does not discuss security issues until a fix is generally available.
Mailing list: Apple's security-announce list.
Homebrew software: follow the advisories of each upstream project, and check Vulnerabilities for exploited flaws.

On an unsupported version

Upgrade to a supported major version. softwareupdate --list-full-installers lists the available macOS installers and softwareupdate --fetch-full-installer downloads the latest one. Test your build tool chain on the new version first, because Xcode and Homebrew support also move on. A Mac that cannot run a supported version should be replaced or taken off the network. See Is my OS supported? for planning.