About the security content of macOS Tahoe 26.6(support.apple.com)
86 pointsby andor3 hours ago5 comments
  • tengwar233 minutes ago
    15.7.8 is out today as well, with these security fixes: https://support.apple.com/en-us/128071.

    For context, there have been issues with MacOS 26 which have led many people to defer upgrading until MacOS 27 is available, and MacOS 15 is the previous version.

    • jghn7 minutes ago
      > For context, there have been issues with MacOS 26 which have led many people to defer upgrading

      For me the issue is liquid glass. Which I doubt is getting fixed any time soon

    • ExoticPearTree4 minutes ago
      26.0 had a very annoying video jitter issue, but that was the first things that I noticed to be fixed in the next 26 release. Other than that, it worked just fine.
    • embedding-shape12 minutes ago
      Same thing happens almost every release. I've stopped updating my Mac machine until I see something in the release notes I literally have to have in order to continue doing macOS/iOS builds, otherwise I'm staying on the version I've validated to work, and I know the existing bugs with.
  • embedding-shape3 hours ago
    Lots of "in collaboration with Claude and Anthropic Research" mentions, no mentions of other labs. I'd assume Apple already had access to whatever the most powerful model is at the various US-based labs, but perhaps not?
    • woadwarrior0138 minutes ago
      Those were voluntary disclosures by two Anthropic researchers and the security firm Calif. I know one more CVE on the list that was discovered using an AI agent, wasn't disclosed to be. I suspect there are many more.
    • tombot2 hours ago
      Apple isn’t friends with OpenAI anymore
    • senadir2 hours ago
      Apple also hosts a copy of Claude internally in their servers.
      • cromka2 hours ago
        Do they? As in Claude but on premises? Wonder if this is gonna be the solution that e.g. banks will require, exactly like they do now for cloud services (e.g. Azure on premises).
        • Cider998636 minutes ago
          Banks are all about security theatre so probably not.
        • pbronezan hour ago
          Pretty extreme solution… you can get Claude models from AWS Bedrock and Google Model Zoo. These are both very helpful for compliance and security, but do require you to have a cloud strategy.
          • ainch43 minutes ago
            Some data is so sensitive it likely has to stay on premises though.
          • UqWBcuFx6NV4ran hour ago
            Yeah, albeit an increasingly second-rate experience, at least when it comes to Bedrock.
  • pjmlp2 hours ago
    Map the amount of fixes with "... improved bounds checking...", "...improved memory handling...", "...improved memory management..." into the amount of developer, QA and release management teams salaries per hour, versus other stuff they could be working on, and that gives an approximate value of how using specific languages maps into monetary loss, and why companies are starting to care nowadays, given computers are always exposed to the world network.
    • snvzz15 minutes ago
      If anything, there's a strong argument to switch to seL4.
    • bluecalman hour ago
      >>, and that gives an approximate value of how using specific languages maps into monetary loss, and why companies are starting to care nowadays, given computers are always exposed to the world network.

      You need also factor development time and ease of finding developers willing to work in a specific language. There are other factors like readability of the code (very verbose languages are likely to be worse) and cost of maintenance - languages forcing a lot of abstractions are likely much worse.

    • UqWBcuFx6NV4ran hour ago
      “nah bro, all those other developers are just garbage, I am the one person that can write memory safe C”
  • nizbit2 hours ago
    Collision counts are absurd. CVE-2026-43739 has roughly twenty credited researchers; CVE-2026-43816 has nearly as many. And ai attribution getting credit.
    • croemer2 hours ago
      One CVE even lists the same person twice!

      CVE-2026-64691: Ruslan Dautov, Ruslan Dautov

  • AJRF3 hours ago
    Weird thing to see at number 3 on HN - is there some subtle context I am missing here?

    Are we wink winking that it's a lot of fixes?

    • microtonal37 minutes ago
      It is a lot of fixes and the Android Security Bulletins of June and Android 17 also had a lot of fixes [1], despite ASBs only containing high/critical vulnerabilities (other vulnerabilities are only fixed in major releases and QPRs, which most Android vendors respectively roll out late or never at all).

      I think the story here is that vulnerability discovery has accelerated a lot with LLMs, but since are adversaries are doing the same, it is more important than ever to update quickly (and not let some Android vendors get away with their lazy update schedules).

      [1] https://source.android.com/docs/security/bulletin/2026/2026-... https://source.android.com/docs/security/bulletin/android-17

    • DStiego2 hours ago
      Relevant context might be for example that there are 4 mentions each of Claude by Anthropic and XGPT by ThreatBook, both based on LLMs.

      AI attribution might be one reason people are particularly curious.

      • AJRF28 minutes ago
        I missed that, thanks for pointing out
    • grahamlee2 hours ago
      And it's not actually that much information "about the security content". For example: "Impact: An app may be able to access sensitive user data. Description: An access issue was addressed with additional sandbox restrictions." This references CVE-2026-43819, which doesn't have any more information. Compare this with the nearly decade-old https://support.apple.com/en-gb/103680, and you see much more specific information about problems and their remedies (except in situations where Apple's action was to update a vendor component).
    • cromka2 hours ago
      I think it's because it's the first big batch of fixes found at Apple by Mythos.
    • croemer2 hours ago
      I think that's it?