04 Sep 2026

417: San Francisco Bay Blues

Goodbye, Tim. Best of luck, John.

Longest serving Apple CEO “retires” to board. John Ternus takes over as Apple CEO. Also, new Mac minis and Mac Studios.

Workbrew, $brew install "shrug", work brew.com

Deliver the software your team needs, securely and at scale.

Homebrew makes it easy to install software fast.

So fast that most installs never get reviewed until after they have consequences.

Workbrew closes that gap: instant visibility, zero-touch deployment via MDM, built-in user support, and fleet-wide default packages. All with SOC 2 and ISO 27001 compliance.

Start free at workbrew.com/free

San Francisco Bay Blues

This week marks the first turnover of an Apple CEO in over 15 years. Tim Cook “retires” to the board of directors, while John Ternus takes over as the new CEO.

Ternus has been at Apple since 2001 and a vice president since 2013. He has worked with Cook and the other leaders at Apple for a long time. No-one expects radical changes. Even so, several other leadership roles have changed this year. The Apple story will certainly remain interesting.

The beta phase for the 27 system updates continued with weekly updates, we are now at the eighth beta. Somewhat of a surprise, Apple also announced a new Mac mini and Mac Studio models, with M6 and M5 Pro, Max, and Ultra chips. This updates are not insignificant, as are the price increases, so it comes as a surprise that Apple would announce them without an event of their own.

The event next week will likely focus on the iPhone and its satellite plarforms. This is now tradition for the September event.

The new Macs will start shipping on September 22 and require macOS 27 Golden Gate. So, if you were wondering when the 27 updates would be released, that would be the last date. From previous release cycles, we can expect a release candidate next week around the event and full release in the week after.

Hope you are prepared!

There is one opening left for sponsoring this news summary this year. If you are interested, please reply to get in touch.

📸 Focus

Apple’s John Ternus Era Begins

Nick Heer, Pixel Envy:

Ternus has inherited that Apple. Regardless of how much he gives off the vibe of a cool Californian […] who just cares about the best stuff, he is also selling ad space and making sure more people upgrade to Apple One.

It’s Tim Cook's last week on the job. Let's review his career

Macalope, MacWorld:

Congrats to Tim Cook on his 15-year anniversary as CEO of Apple! Here are some balloons and a gift card to the Olive Garden. There will be cake in the break room.

📰 News and Opinion

Reflections on my stint as an admin of the Mac Admins Slack

Graham Pugh:

Reflecting on my time as a Mac Admins Slack admin, I look back on community stewardship, the challenges of AI and data scraping, and why human conversations remain the heart of the community.

Upcoming changes to Rosetta support for Intel-based macOS apps

Apple Developer:

macOS 27: Final release to support Rosetta — Intel-only apps will no longer run on Mac computers with Apple silicon after this update.

Not really news when you have been reading this or other Mac management related news. But, this official notice from Apple might be good to have around when talking with developers who are dragging their feet.

⚙️ Apple Updates

Golden Gate and forthcoming updates

Howard Oakley:

At the same time as the release of Golden Gate, we should get Tahoe 26.7 and Sequoia 15.8, but it looks increasingly likely that the final version of Sonoma has been 14.8.9, released on 6 August.

🔐 Security and Privacy

Detecting (Evil) Dylibs

Patrick Wardle:

we’ll first highlight examples of attackers abusing dylibs for persistence, payloads, and even exploits. Then, we’ll show how we can programmatically enumerate dylibs statically on disk, at runtime in a remote process, and as they are being loaded.

Rustbot, the macOS malware used in the latest Rust Supply Chain Attack

Cristian Molina, The Iru Blog:

From the arm64 sample we documented the on-disk characteristics of the Mach-O, the LaunchAgent persistence chain, and the collection target map, with observed and inferred paths distinguished.

Contagious Interview steps outside the developer workflow

Jamf Threat Labs:

Jamf Threat Labs identified a cluster of macOS disk images (DMG) and installer packages (PKG) impersonating known Mac applications.

Csaba Fitzl, The Iru Blog:

In late July 2026, a cluster of vulnerabilities in macOS Screen Sharing turned what initially looked like a fairly constrained privilege problem into one of the more interesting macOS remote-attack stories in years.

🔨 Support and Tutorials

How I Find Problems to Solve as a Staff Engineer

Lalit Maganti:

finding problems worth solving isn’t separate from the rest of the job. It comes from staying engaged with people’s work long enough to see what no single request can show you.

Back to the Future: Retroactively activating the macOS User Channel post-enrolment

Philip Ross:

For many organisations, their current macOS provisioning process doesn't make the user MDM-enabled. Here's an example of how you can activate that for your already enrolled devices.

Checking APNS communication on macOS Tahoe

Rich Trouton:

What I did figure out was that you could check to see if the Mac in question is communicating properly with APNS.

Managing OS updates in a lab environment since Tahoe

Fabien:

I manage an environment where all computers are shared, and none of the users have a local account (we are still AD-bound). In this situation, managing macOS updates is very tricky.

Simplified Setup for Platform Single Sign-on for Mac (Jamf Pro + Intune) - Addendum

HCS Technology Group:

This addendum supplements the parent guide, How to Configure Jamf Pro and Intune Company Portal for macOS Platform SSO Integration, by adding three required keys to the existing Platform SSO configuration profile and configuring a PreStage Enrollment to enable the Setup Assistant pause.

MacBook Imaging at Scale: Restore, Verify, and Checkout

Marriott Library, Apple Infrastructure:

This post is about what happens when a Mac imaging workflow grows large enough that manual attention becomes the bottleneck.

🤖 Scripting and Automation

munkipkg no longer in development

swiftpkg works with your existing munkipkg projects, and the command-line tool has the same core feature set that munkipkg has, so you should be able to switch tools easily.

munkipkg has been a big inspiration and learning source for my own package building workflows

swiftpkg seems to be a useful tool going forward, but that shouldn’t also keep you learning to build packages on the command line.

Using the Jamf Pro API to retrieve Recovery Lock passwords

Rich Trouton:

uses the Jamf Pro API to take a list of Jamf Pro computer IDs from a plaintext file, retrieve the associated Macs’ Recovery Lock passwords (if one is set) and generate a report in TSV format.

Apple is deprecating hdiutil in macOS 27 Golden Gate. Are your scripts ready?

Arek Dreyer, The Iru Blog:

If you spent part of last weekend fielding Slack messages about hdiutil, you're not alone. Jeff Johnson's lapcatsoftware.com blog flagged that the man page for hdiutil in the macOS 27 Golden Gate beta now carries a deprecation notice

♻️ Updates and Releases

📺 Watch

Managing macOS Default Applications with utiluti

Ross Matsuda on Marriot Library, Mac Admins Meetup

Deploying an application is only half the battle. If macOS continues opening files and links with the wrong application, users still experience friction—and your deployment may not achieve the behavior you intended.

🎧 Listen

Live at X World 2026

Mac Admins Podcast:

Live at X World in Melbourne, James and Marcus are joined by some of the other attendees and speakers.

Resetting AirTags, Beta Bugs, and Vibe-Coded Mac Health Checks

Command Control Power:

how to reset an Apple AirTag by inserting and removing the battery five times until a different sound plays, noting newer AirTags may require pressing down. They share issues seen on iOS 27 and macOS betas

The human side of AI adoption in the enterprise

Apple @ Work:

Dr. Gleb Tsipursky joins the show to talk about the human side of AI adoption in the enterprise, his books, and much more.

You’ll Always Have Air, But There Might Be a Bomb

Mac Admins Podcast:

Arek’s back with us! We’re going to be talking about life, the universe, and everything.

Breaking down Apple's bug bounty cap and cool down period

Apple @ Work:

to5Mac's Arin Waichulis joins me to talk about Apple's decision to put in cool-down periods on its bug bounty submission program.

🎈 Just For Fun

Summit

BasicAppleGuy:

With a soft, Cubist-inspired style and plenty of colour, the Summit Series brings a simple mountain aesthetic to your devices.

Sponsor