A lot has changed in recent versions of macOS over the last couple of weeks. This is a summary of what’s happened, and the updates available for Macs running Mojave, Catalina and Big Sur.

Mojave

Apple released Mojave Security Update 2021-003 on 26 April 2021. Its security release notes are here, and a standalone installer package is available from here.

Apple also released an update to Safari 14.1, but the inital update contained some bugs which made it impossible to access some websites. An updated update now fixes those, and contains urgent fixes for two vulnerabilities affecting WebKit which Apple believes are already being exploited, as detailed here.

Apple strongly recommends all those using Mojave to install Security Update 2021-003 and update Safari to 14.1. Once you have done that, check the build number of Safari is now 14611.1.21.161.7 to ensure that you’re fully protected.

Anyone choosing to delay or deny either of these two important security updates needs to run additional security software to ensure that their vulnerable system is protected against these exploits: you’re on your own!

Catalina

Apple released Catalina Security Update 2021-002 on 26 April 2021. Its security release notes are here, and a standalone installer package is available from here.

Apple also released an update to Safari 14.1, but the inital update contained some bugs which made it impossible to access some websites. An updated update now fixes those, and contains urgent fixes for two vulnerabilities affecting WebKit which Apple believes are already being exploited, as detailed here.

Apple strongly recommends all those using Catalina to install Security Update 2021-002 and update Safari to 14.1. Once you have done that, check the build number of Safari is now 15611.1.21.161.7 to ensure that you’re fully protected.

Anyone choosing to delay or deny either of these two important security updates needs to run additional security software to ensure that their vulnerable system is protected against these exploits: you’re on your own!

Big Sur

Apple released Big Sur 11.3 on 26 April 2021. Its security release notes are here. Among the vulnerabilities it fixes is a major security vulnerability explained in detail by Patrick Wardle. The message is clear that all Big Sur users should update as soon as they can.

That update included an update bringing Safari and WebKit to version 14.1, but that has since proved to contain two serious vulnerabilities which Apple believes are already being exploited. Those are addressed in Big Sur 11.3.1, released on 3 May 2021. Its security release notes are here. That update increments the Safari and WebKit build numbers from 16611.1.21.161.3 to 16611.1.21.161.6, and it’s worth checking that happens correctly once you’ve installed the 11.3.1 update.

Apple strongly recommends all those using Big Sur to update to 11.3.1. However, Apple doesn’t provide any standalone updaters to help this, and you’ll need to use Software Update. If you’re unable to do that, or that update fails (as it may on external bootable disks attached to an M1 Mac), you’ll need to download the full 11.3.1 installer, from the App Store or softwareupdate command tool, or Mr Macintosh’s alternate Apple sources. Although running the full installer shouldn’t break your current Data volume, you must ensure that you have a good backup before trying that, in case it does.

Anyone choosing to delay or deny these important security updates needs to run additional security software to ensure that their vulnerable system is protected against these exploits: you’re on your own!

All users Mojave to Big Sur

Be aware that after applying these system and security updates, you may find that the versions of XProtect and MRT have been downgraded by the upgrade. These should correct automatically over the following minutes, but if they don’t, you should use my free SilentKnight to check, download and install them.

The above is current as of 0630 UTC 5 May 2021.