Apple has released an update to XProtect for all macOS

Apple has just released its regular update to XProtect, bringing it to version 5360, for all versions of macOS. Version 5359 doesn’t appear to have been released. As usual Apple doesn’t release information about what security issues this update might address.

This version adds six new Yara rules for MACOS.BONZAI.NCIMA, MACOS.LOATHESOMELABELMAKER.WHCO, MACOS.SHADYSHOELACE.AECRCOAR, MACOS.SHADYSHOELACE.LOADCO, MACOS.ANGRYORB.RUC2FO and MACOS.ANGRYORB.RUCOX8, and fixes whitespace in rules for MACOS.SHADYSHOELACE.OSLOSTA and MACOS.SHADYSHOELACE.LODLSYDEX8.

In the Osascript rules in XPScripts.yr it adds seven new rules for MACOS.OSASCRIPT.SHC2ST, MACOS.OSASCRIPT.SHLAMAA, MACOS.OSASCRIPT.SHCHEXHA, MACOS.OSASCRIPT.SHCOST, MACOS.OSASCRIPT.SHKEACRE, MACOS.ANGRYORB.JXDR and MACOS.OSASCRIPT.ANJXLO, amends MACOS.OSASCRIPT.SYPR, and fixes whitespace in MACOS.OSASCRIPT.DUEXKE.

In older versions of macOS you can check whether this update has been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight and SystHist for El Capitan to Golden Gate available from their product page. If your Mac hasn’t yet installed this update, you can force it using SilentKnight or at the command line.

If you want to install this as a named update in SilentKnight, its label is XProtectPlistConfigData_10_15-5360

Sequoia, Tahoe and Golden Gate systems only

This update has now been released for Sequoia and later via iCloud. If you want to check it manually, use the Terminal command
sudo xprotect check
then enter your admin password. If that returns version 5360 but your Mac still reports an older version is installed, you should be able to force the update using
sudo xprotect update
Overnight these commands have now started working again in macOS Sequoia 15.8, Tahoe 26.7 and Golden Gate 27.0, and should no longer return errors.

Updated 06:20 18 September 2026 with changes to xprotect commands.

6Comments

Add yours

1

dafoxe1 on September 17, 2026 at 7:54 pm

Hi Howard, just FYI SK3 3.0.2 is having a hard time with the new processes in macOS 27.0 on my Mac mini M2 Pro. Just now it returned:

“XProtect found 5358, XProtect expected 5360, XProtect last updated XProtectPlistConfigData 2026-09-17 xxx: 5360

XPR found 159, XPR expected 157, XPR last updated XProtectPayloads 2026-07-26 xxx: 157″

I think you likely know this already, if so just ignore my comment.

LikeLiked by 1 person
- 2
  
  hoakley on September 17, 2026 at 9:11 pm
  
  Thank you.
  I have already explained what is going on in this recent article.
  XProtect can only be updated by macOS now, not manually.
  XPR in GG is version 159, and has been from the first beta-release, as that’s a version specific to GG.
  There is absolutely nothing that I or SK can do to change those, I’m afraid.
  Howard.
  
  LikeLike
3

Nick D. on September 18, 2026 at 2:13 am

Silent Knight and Terminal were showing that the update had not occurred, so I just tried (about 10pm EST), for fun, to use “sudo xprotect update” and it worked as it did a few weeks or months ago under Tahoe. Both terminal and Silent knight report the update as having worked. I am running macOS 27 (build 26A428).

LikeLiked by 2 people
- 4
  
  Alan B on September 18, 2026 at 6:39 am
  
  I’m running macOS 27.0 now and I tried sudo XProtect update too. Much to my surprise and delight it worked :)
  
  LikeLiked by 1 person
  - 5
    
    hoakley on September 18, 2026 at 6:41 am
    
    Just like someone remembered to turn something on.
    Howard
    
    LikeLiked by 1 person
- 6
  
  hoakley on September 18, 2026 at 10:50 am
  
  Thank you for that catch – you’re correct, Apple fixed whatever it had broken.
  Howard.
  
  LikeLike

Sequoia, Tahoe and Golden Gate systems only

Share this:

Related