Apple has just released security updates to bring macOS Golden Gate to 27.2.1, Tahoe to 26.7.3, and Sequoia to 15.8.3. I expect there will also be separate Safari updates for Tahoe and Sequoia.

The 27.2.1 update is around 3.33 GB in size.

The macOS 27.2.1 build number is 26B131, Safari’s new version number is 27.2 (22625.2.8.11.9), and there is no update to mBoot firmware for Apple silicon Macs.

Security release notes are now available for Golden Gate, Tahoe and Sequoia. Each lists the same eight items, among them a vulnerability in AirPlay and two in Messages. None is reported as having been actively exploited in the wild yet.

Apple has also confirmed that these updates address the problem of compromised eMudhra intermediate certificates by updating /etc/ssl/cert.pem and blocking the certificates in command tools bundled in macOS and Xcode. Full information is here, but Apple stresses that these fixes don’t extend to older versions of macOS, whose users appear to be left to fend for themselves by removing the certificates manually.

Looking at versions and build numbers, the only change in bundled apps is a single build increment in Messages.

In /System/Library, there are relatively few changes, among them:

• Screen Time and some of its supporting components have a substantial increment in build number.
• The CoreSpotlight framework also has a substantial build increment.
• There are build increments to AirPlay components.
• In Private Frameworks, there’s a build increment to the CSExattrCrypto framework.
• Many Spotlight Private Frameworks have build increments.

There has been no change in the version of APFS.

Last updated 20:15 GMT 9 November 2026. Thanks to Mr. Macintosh for info about the compromised certificates.