❌

Normal view

Received — 9 September 2026 ⏭ MacAdmins

417: San Francisco Bay Blues

✇MacAdmins
By: Armin Briegel
4 September 2026 at 15:05
417: San Francisco Bay Blues

Longest serving Apple CEO “retires” to board. John Ternus takes over as Apple CEO. Also, new Mac minis and Mac Studios.

Sponsor

417: San Francisco Bay Blues

Deliver the software your team needs, securely and at scale.

Homebrew makes it easy to install software fast.

So fast that most installs never get reviewed until after they have consequences.

Workbrew closes that gap: instant visibility, zero-touch deployment via MDM, built-in user support, and fleet-wide default packages. All with SOC 2 and ISO 27001 compliance.

Start free at workbrew.com/free

San Francisco Bay Blues

This week marks the first turnover of an Apple CEO in over 15 years. Tim Cook “retires” to the board of directors, while John Ternus takes over as the new CEO.

Ternus has been at Apple since 2001 and a vice president since 2013. He has worked with Cook and the other leaders at Apple for a long time. No-one expects radical changes. Even so, several other leadership roles have changed this year. The Apple story will certainly remain interesting.

The beta phase for the 27 system updates continued with weekly updates, we are now at the eighth beta. Somewhat of a surprise, Apple also announced a new Mac mini and Mac Studio models, with M6 and M5 Pro, Max, and Ultra chips. This updates are not insignificant, as are the price increases, so it comes as a surprise that Apple would announce them without an event of their own.

The event next week will likely focus on the iPhone and its satellite plarforms. This is now tradition for the September event.

The new Macs will start shipping on September 22 and require macOS 27 Golden Gate. So, if you were wondering when the 27 updates would be released, that would be the last date. From previous release cycles, we can expect a release candidate next week around the event and full release in the week after.

Hope you are prepared!

Looking for Sponsor!

There is one opening left for sponsoring this news summary this year. If you are interested, please reply to get in touch.

📸 Focus

Apple’s John Ternus Era Begins

Nick Heer, Pixel Envy:

Ternus has inherited that Apple. Regardless of how much he gives off the vibe of a cool Californian […] who just cares about the best stuff, he is also selling ad space and making sure more people upgrade to Apple One.

It’s Tim Cook's last week on the job. Let's review his career

Macalope, MacWorld:

Congrats to Tim Cook on his 15-year anniversary as CEO of Apple! Here are some balloons and a gift card to the Olive Garden. There will be cake in the break room.

📰 News and Opinion

Reflections on my stint as an admin of the Mac Admins Slack

Graham Pugh:

Reflecting on my time as a Mac Admins Slack admin, I look back on community stewardship, the challenges of AI and data scraping, and why human conversations remain the heart of the community.

Upcoming changes to Rosetta support for Intel-based macOS apps

Apple Developer:

macOS 27: Final release to support Rosetta — Intel-only apps will no longer run on Mac computers with Apple silicon after this update.

Not really news when you have been reading this or other Mac management related news. But, this official notice from Apple might be good to have around when talking with developers who are dragging their feet.

⚙️ Apple Updates

Golden Gate and forthcoming updates

Howard Oakley:

At the same time as the release of Golden Gate, we should get Tahoe 26.7 and Sequoia 15.8, but it looks increasingly likely that the final version of Sonoma has been 14.8.9, released on 6 August.

🔐 Security and Privacy

Detecting (Evil) Dylibs

Patrick Wardle:

we’ll first highlight examples of attackers abusing dylibs for persistence, payloads, and even exploits. Then, we’ll show how we can programmatically enumerate dylibs statically on disk, at runtime in a remote process, and as they are being loaded.

Rustbot, the macOS malware used in the latest Rust Supply Chain Attack

Cristian Molina, The Iru Blog:

From the arm64 sample we documented the on-disk characteristics of the Mach-O, the LaunchAgent persistence chain, and the collection target map, with observed and inferred paths distinguished.

Contagious Interview steps outside the developer workflow

Jamf Threat Labs:

Jamf Threat Labs identified a cluster of macOS disk images (DMG) and installer packages (PKG) impersonating known Mac applications.

Inside the screensharingd Bugs: How macOS Screen Sharing Went from Root File Access to Pre-Auth Compromise

Csaba Fitzl, The Iru Blog:

In late July 2026, a cluster of vulnerabilities in macOS Screen Sharing turned what initially looked like a fairly constrained privilege problem into one of the more interesting macOS remote-attack stories in years. 

🔨 Support and Tutorials

How I Find Problems to Solve as a Staff Engineer

Lalit Maganti:

finding problems worth solving isn’t separate from the rest of the job. It comes from staying engaged with people’s work long enough to see what no single request can show you.

Back to the Future: Retroactively activating the macOS User Channel post-enrolment

Philip Ross:

For many organisations, their current macOS provisioning process doesn't make the user MDM-enabled. Here's an example of how you can activate that for your already enrolled devices.

Checking APNS communication on macOS Tahoe

Rich Trouton:

What I did figure out was that you could check to see if the Mac in question is communicating properly with APNS.

Managing OS updates in a lab environment since Tahoe

Fabien:

I manage an environment where all computers are shared, and none of the users have a local account (we are still AD-bound). In this situation, managing macOS updates is very tricky.

Simplified Setup for Platform Single Sign-on for Mac (Jamf Pro + Intune) - Addendum

HCS Technology Group:

This addendum supplements the parent guide, How to Configure Jamf Pro and Intune Company Portal for macOS Platform SSO Integration, by adding three required keys to the existing Platform SSO configuration profile and configuring a PreStage Enrollment to enable the Setup Assistant pause.

MacBook Imaging at Scale: Restore, Verify, and Checkout

Marriott Library, Apple Infrastructure:

This post is about what happens when a Mac imaging workflow grows large enough that manual attention becomes the bottleneck.

🤖 Scripting and Automation

munkipkg no longer in development

swiftpkg works with your existing munkipkg projects, and the command-line tool has the same core feature set that munkipkg has, so you should be able to switch tools easily.

munkipkg has been a big inspiration and learning source for my own package building workflows

swiftpkg seems to be a useful tool going forward, but that shouldn’t also keep you learning to build packages on the command line.

Using the Jamf Pro API to retrieve Recovery Lock passwords

Rich Trouton:

uses the Jamf Pro API to take a list of Jamf Pro computer IDs from a plaintext file, retrieve the associated Macs’ Recovery Lock passwords (if one is set) and generate a report in TSV format.

Apple is deprecating hdiutil in macOS 27 Golden Gate. Are your scripts ready?

Arek Dreyer, The Iru Blog:

If you spent part of last weekend fielding Slack messages about hdiutil, you're not alone. Jeff Johnson's lapcatsoftware.com blog flagged that the man page for hdiutil in the macOS 27 Golden Gate beta now carries a deprecation notice

♻️ Updates and Releases

📺 Watch

Managing macOS Default Applications with utiluti

Ross Matsuda on Marriot Library, Mac Admins Meetup

Deploying an application is only half the battle. If macOS continues opening files and links with the wrong application, users still experience friction—and your deployment may not achieve the behavior you intended.

🎧 Listen

Live at X World 2026

Mac Admins Podcast:

Live at X World in Melbourne, James and Marcus are joined by some of the other attendees and speakers.

Resetting AirTags, Beta Bugs, and Vibe-Coded Mac Health Checks

Command Control Power:

how to reset an Apple AirTag by inserting and removing the battery five times until a different sound plays, noting newer AirTags may require pressing down. They share issues seen on iOS 27 and macOS betas

The human side of AI adoption in the enterprise

Apple @ Work:

Dr. Gleb Tsipursky joins the show to talk about the human side of AI adoption in the enterprise, his books, and much more.

You’ll Always Have Air, But There Might Be a Bomb

Mac Admins Podcast:

Arek’s back with us! We’re going to be talking about life, the universe, and everything.

Breaking down Apple's bug bounty cap and cool down period

Apple @ Work:

to5Mac's Arin Waichulis joins me to talk about Apple's decision to put in cool-down periods on its bug bounty submission program.

🎈 Just For Fun

Summit

BasicAppleGuy:

With a soft, Cubist-inspired style and plenty of colour, the Summit Series brings a simple mountain aesthetic to your devices.

416: All Summer Long

✇MacAdmins
By: Armin Briegel
21 August 2026 at 15:10
416: All Summer Long

Security updates for iOS, macOS, and visionOS, with more in beta. Also 27 beta 5 and beta 6 releases,.

Sponsor

416: All Summer Long

Manual patching is slow, inconsistent, and leaves security gaps. Alectrona Patch automates updates for 800+ Mac applications, so every device stays protected with the latest security fixes—without interrupting your users.

Trusted by security teams and IT administrators alike, Alectrona Patch helps you:

  • Reduce time to patch critical applications
  • Reduce end-user support tickets with clear, customizable guidance
  • Deliver silent, automated updates
  • Keep users both secure and productive

Spend less time patching. Spend more time securing your environment.
 Start your free trial at alectrona.com/patch

All Summer Long

The fifth and sixth betas for the 27 platforms came out with just a week between them. It has actually been quite common for Apple to switch to weekly beta release some time in August, so this is progressing normally.

There is a notion that now is too late for providing feedback to Apple, since the chance is low for a fix or change to be included in the .0 release in September. While it is true that the likelihood is greatest early in the beta phase, getting something fixed or adjusted now is not impossible, when Apple deems it important enough. Also, there will be later updates, the .1 update usually arrives about six weeks after the .0 in late October or early November and the .2 release in December. These updates will have improvements for your feedback, but only if you tell Apple about your problems.

So, keep testing those betas and creating the feedback. Also, document issues you might find. If Apple doesn't fix and we can’t solve them, we can at least document them and warn users when 27.0 inevitably drops in September.

📰 News and Opinion

Punk Shows to Patch Management: Richard Glaser's Mac Admin Career

Kitty Shephard, Workbrew Blog:

Before Richard Glaser was a Solutions Architect, he was a math major working the library's computer lab by day, and living a whole other life by night: playing guitar in punk and alternative bands,

More Than a Conference: 2026 Mac Admins India Connect's Second Year

Kartikeyan Marappan, Jamf Tech Thoughts:

What began as an idea has now become India’s largest community-driven conference dedicated to Apple IT professionals.

Decades After HyperCard, AI Is Democratizing Development Again

Adam Engst, TidBITs:

Here’s where I’m coming from, where I’ve seen the personal programming world evolve, and where I see AI development taking us with the kinds of apps and systems we use on our Apple devices today.

Agent assisted coding satisfies the need to build very customized workflows for your personal needs. As Adam recounts in this article, there have been several solutions in this regard over the past few decades, some of which were quite successful, but all seem to have fallen by the wayside for some reason or other.

I don’t want to dismiss the desire to build your own custom solutions and workflows, but I feel sad that the “magic wand” here is based on something so riddled with ethical, economical and social concerns. What could we have had, if Apple continued to improve Hypercard or AppleScript over the last two or three decades? What could be, if Apple or another company had invested a fraction of the investment of AI development into personal, simple automation?

⚙️ Apple Updates

Support

Apple has released a security update to macOS Tahoe 26.6.2

Howard Oakley:

Apple has just released a security update to macOS Tahoe, bringing it to version 26.6.2. There don’t appear to any matching security updates to Sequoia or Sonoma, though.

Apple fixes another image-processing flaw that could allow code execution

Pieter Arntz, Malwarebytes:

Apple has released security updates for more than two dozen security vulnerabilities across iPhone, iPad, and macOS Tahoe,including yetanother image parsing vulnerability that could compromise your device.

Apple beta testing and device management services: the perfect match

MIke Boylan, Iru Blog:

Every fall, Apple’s newest operating systems arrive everywhere at once. That’s great for users, but it puts IT teams on the clock: they need to validate the release, find blockers, prepare their support teams, and decide when the business is ready to move.

🔐 Security and Privacy

Apple Threat Notification: What to Do If You're Targeted

Elad Shapira, Jamf Blog:

Apple's Threat Notifications signal mercenary spyware targeting; learn verification steps, response actions, and layered mobile security defenses for high-risk users.

How a single PostScript file leaks your Mac's memory

Csaba Fitzl, Iru Blog:

The vulnerability is in the Spotlight PostScript plugin.

AmnesiaStealer: macOS Infostealer That Hijacks Browsers

Thijs Xhaflaire, Jamf Threat Labs:

Jamf Threat Labs discovers and investigates AmnesiaStealer, a multi-stage Rust-based macOS infostealer spread through a counterfeit GitHub download page that captures the login password, reaches for macOS bypasses Apple has already patched, and can hand the operator live, hidden control of the victim's Chromium browser to steal authenticated sessions.

🔨 Support and Tutorials

Dock Management on macOS: From User Templates to Swift Tools

Marriott Library - Apple Infrastructure:

For MacAdmins, the Dock has always been a deceptively small thing with a big operational footprint. It is the first place many users look for the tools they need, and it is one of the first places they notice when a Mac does not feel ready for work.

Build and validate configuration profiles with AI instead of a GUI

Kitzy, Fleet Blog:

the picker constrains you to settings that exist, with values the platform accepts, and that constraint is the real value of the tool.

Admin-eers, standby... 3, 2, 1... ACTIVATE: Stacking DDM predicates to lean out Jamf Blueprints

Philip Ross:

Activation Predicates are a powerful way of controlling which devices in your fleet are applied with which controls, without having to create and maintain endless blueprints and scoping groups.

Apple Software Updates Need a Blueprint Before the MDM Commands Fade

Jon Brown:

Apple is not eliminating remotely managed software updates. It is changing how we manage them. The replacement is Declarative Device Management

🤖 Scripting and Automation

Uninstalling Adobe on macOS: A Character-Building Exercise

Marriott Library - Apple Infrastructure:

Historically, Adobe has not always aligned cleanly with Apple’s preferred installation and removal workflows, so MacAdmins have often had to adapt their processes around Adobe’s packaging, licensing, and uninstall behavior.

Part 2: The Character-Building Exercise Gets Specific

Reporting on Jamf Pro API Role permissions

Rich Trouton:

It later occurred to me that a more comprehensive report which includes the permissions assigned to the roles may be wanted

Validating FileVault recovery keys using a plist file to provide recovery key information on macOS Tahoe

Rich Trouton:

it was asked if it was possible to validate a FileVault personal recovery key (PRK) without having to interactively enter it.

Some Notes about Jamf Pro Inventory Data Sync Applications

macnotes:

if a device is added or deleted while you’re fetching pages, rows can shift across the offset boundary, potentially causing a record to be skipped entirely or to show up twice across two different page requests.

♻️ Updates and Releases

📺 Watch

Beyond WWDC: What the 2026 macOS beta cycle looks like in the field

David Starr, Tom Bridge, Workbrew Webinars:

a practical conversation on the 2026 macOS beta cycle: what’s actually working, what’s still rough, and what IT teams should be paying attention to as the fall release gets closer.

🎧 Listen

Using Claude for IT Fixes: Printer Pools, Chrome Log Sleuthing, UniFi IoT Wi‑Fi, and iPhone Protection Tips

Command Control Power:

The hosts discuss confusion caused by Microsoft’s email warning that Publisher will end in October 2026 and urging users to convert files to PDF.

Agentic networking actions

Apple @ Work:

Shirish Nimgaonkar from eBlissAI joins the show to talk about AI’s future in enterprise around endpoint management, agentic solutions, and more.

300 devices later - thoughts on ChromeOS vs macOS

Apple @ Work:

I go solo as I talk through the good and bad of ChromeOS and macOS deployments after spending a lot of time with each.
❌