One thing almost all of us did with our Macs last week was to update them. Even if it had been left behind because it doesn’t have a T2 or Apple silicon chip, you’re likely to have installed XProtect 5353, released a mere four days after version 5352. For anyone running macOS Sonoma or later, security updates to 14.8.8 or 15.7.8, or Tahoe 26.6, brought the largest number of vulnerabilities addressed in a single update. How could we possibly refuse?

Looking at the numbers, each of the three supported versions of macOS has been updated to address well over a hundred vulnerabilities. The precise numbers are complicated, as 15.7.8 and 14.8.8 had separate Safari updates, and were also catching up with at least half a dozen fixes released in 26.5.2, which had no matching security update for macOS 14 or 15. But exact counts hardly matter among such large numbers.

Security researchers have remarked on something unusual in this batch of Apple’s security release notes. Many of those vulnerabilities appear to have been in open source, and were reported by multiple teams. For example, a use-after-free bug that was fixed in the kernel had been reported in five CVEs by a crowd of a dozen researchers. In a few cases, entries also explicitly credit the contributions made by AI such as Claude.

That doesn’t mean the bugs fixed are unimportant, nor that these updates can be ignored. Human expert assessments confirm that several of the vulnerabilities could have been exploited to our cost, including one affecting Screen Sharing. When assessing vulnerability reports, Apple’s security engineers have to be rigorous, as there are payments at stake under its Security Bounty programme, as well as reputations. The bugs are real, and had to be fixed, but how many would ever have been exploited by malicious software is open to discussion.

As other security researchers point out, at present the greatest threats aren’t these vulnerabilities, but our seemingly unlimited capacity to fall for the behavioural deception of ClickFix attacks. Why should an attacker have to negotiate their exploit through an elaborate chain of vulnerabilities, when all it takes is a little cunning to trick us into installing their malware for them?

Beyond those long and impressive lists, last week’s updates apparently only merited a single cryptic note, that Tahoe 26.6 “optimizes the Spotlight index in preparation for macOS 27”. That in itself raises further questions, including whether those changes were also applied to Spotlight indexes in Intel Macs, which of course will never be able to run Golden Gate, and how this will work for Spotlight indexes on external storage that could used under macOS 26 or 27. As Apple doesn’t even mention Spotlight indexes in its current release notes for Golden Gate betas, we’re once again left puzzled rather than being informed.

In all probability macOS Tahoe 26.6 has brought the last batch of improvements and general bug fixes for Intel Macs, with future updates confined to security as it’s displaced by Golden Gate. Those remaining with the old architecture may also be unimpressed that Apple has found resources to prepare Spotlight indexes for an impossible upgrade, but hasn’t done anything to address its longstanding bugs, that will blight their Macs until they’re replaced.

For those with Apple silicon Macs who prefer to let others grapple with the new version of macOS in a couple of months, Tahoe hasn’t mellowed much or grown any more attractive over the last ten months. If you didn’t like its look when it was first released last year, the changes to Liquid Glass since then have fallen short of those to come in Golden Gate. If you’ve remained with Sequoia, you’ll probably prefer to skip straight to macOS 27 later this year, when we’ve had a better chance to confirm the performance improvements it’s expected to bring.

The phrase onward and upward became a slogan among Victorian moralisers, and the philanthropist Ishbel Hamilton-Gordon (1857-1939), Marchioness of Aberdeen and Temair, even founded an Onward and Upward Association to improve domestic servant girls in the 1880s. Perhaps its modern equivalent is onward and update, as it has been over the past week. At least it’s now August.