Today’s threats

Every security headline that matters, translated for Macs. The Briefing is rebuilt every hour from CISA, Apple, Chrome, Firefox and Electron, and signed so nobody can slip in a fake one.

Updated 15 minutes ago. Signed, and checked here against the same key the app trusts.

Check my Mac, free

In the news

Security stories making headlines, and what they mean for a Mac.

  1. Brotli (HTTP2Shell)Matters for Node.js, Python's Brotli packages, and Homebrew's Brotli library, which Homebrew's curl uses.In the news
  2. PHP2ShellMatters if PHP is installed on your Mac, for example for local web development. The websites you use have to patch their own servers; nothing on your Mac changes that.In the news

Used in attacks

Flaws Apple, Google or CISA say attackers are already using.

  1. CoreGraphics flaw used in targeted attacksEvery Mac still on an affected version. The fix comes with the macOS update.Attackers are using this
  2. Chrome flaw used in attacks (JavaScript engine)Chrome and other Chromium browsers, and apps built on Electron or Chromium. Each app carries its own copy, so it stays exposed until that app updates, even when Chrome is current.Attackers are using this
  3. Chrome flaw used in attacks (JavaScript engine)Chrome and other Chromium browsers, and apps built on Electron or Chromium. Each app carries its own copy, so it stays exposed until that app updates, even when Chrome is current.Attackers are using this
  4. Screen Sharing Server flaw used in attacksEvery Mac still on an affected version. The fix comes with the macOS update.Attackers are using this
  5. Chrome flaw used in attacks (JavaScript engine)Chrome and other Chromium browsers, and apps built on Electron or Chromium. Each app carries its own copy, so it stays exposed until that app updates, even when Chrome is current.Attackers are using this
  6. Chrome flaw used in attacksChrome and other Chromium browsers, and apps built on Electron or Chromium. Each app carries its own copy, so it stays exposed until that app updates, even when Chrome is current.Attackers are using this
  7. Chrome flaws used in attacksChrome and other Chromium browsers, and apps built on Electron or Chromium. Each app carries its own copy, so it stays exposed until that app updates, even when Chrome is current.Attackers are using this
  8. Chrome flaw used in attacksChrome and other Chromium browsers, and apps built on Electron or Chromium. Each app carries its own copy, so it stays exposed until that app updates, even when Chrome is current.Attackers are using this
  9. dyld flaw used in targeted attacksEvery Mac still on an affected version. The fix comes with the macOS update.Attackers are using this
  10. WebKit flaws used in targeted attacksEvery Mac still on an affected version. The fix comes with the macOS update, and as a Safari update on older macOS versions.Attackers are using this
  11. Chrome flaw used in attacksChrome and other Chromium browsers, and apps built on Electron or Chromium. Each app carries its own copy, so it stays exposed until that app updates, even when Chrome is current.Attackers are using this
  12. Chrome flaw used in attacks (JavaScript engine)Chrome and other Chromium browsers, and apps built on Electron or Chromium. Each app carries its own copy, so it stays exposed until that app updates, even when Chrome is current.Attackers are using this
  13. Kernel flaws used in attacksEvery Mac still on an affected version. The fix comes with the macOS update.Attackers are using this

Security updates

The newest security release of each product. Anything older is missing fixes.

  1. macOS security updatesEvery Mac. A macOS version Apple no longer updates is listed as getting no fix; moving to a supported version is the only way to get them.Security update
  2. Safari security updateAnyone who uses Safari. On the newest macOS it comes with the macOS update; on older versions, as its own update in Software Update.Security update
  3. Apps on an out-of-support ElectronApps on your Mac built with Electron. Only the app’s maker can move it to a supported version; update the app, and if it’s still listed, ask them or use the website instead.Security update
  4. Firefox security updateAnyone who uses Firefox. Firefox updates itself when it restarts; Help › About Firefox checks right away.Security update
  5. Chrome security updateChrome and other Chromium browsers. Browsers that number their own builds, and apps that embed Chromium, are listed only when a whole version behind.Security update

Where it comes from

  • CISA Known Exploited Vulnerabilities1758 entries
  • Apple security releases118 macOS and Safari releases, 41 pages read
  • Chrome Releases86 stable desktop updates
  • Electron releases1220 stable releases
  • Mozilla security advisories214 advisories

Is it on your Mac?

Mac Shield checks every advisory here against what’s installed on your Mac, free.

Download freeSee pricing

Version 1.0.1, Oct 26
macOS 14 Sonoma or later
Apple silicon and Intel, notarized by Apple