Is Your Mac Still Getting Security Updates? Apple Never Tells You

On September 14, 2026, Apple released macOS 27 Golden Gate. Two things happened that day that nobody's Mac mentioned. The first was that four Intel Mac models dropped off the list of computers the new macOS will install on — the last four there were. The second, and the one almost nobody noticed, is that macOS Sonoma stopped being patched. Its final security update had gone out on August 6, 2026. When the September batch arrived, Tahoe and Sequoia got one and Sonoma did not, and that was the whole announcement.

This is the part that makes Macs different from every other computer we look after, and it catches out careful people rather than careless ones. When Windows 10 ran out of support, Microsoft had published the date years in advance, put it on a lifecycle page, and eventually pushed full-screen notices onto the machines themselves. A Chromebook tells you its expiry date in Settings and then puts a banner on the screen when it arrives. A Mac does neither. Apple has never published an end-of-support date for a version of macOS, does not send a notification when yours stops being patched, and — this is the genuinely awkward part — leaves your Mac looking exactly the same afterwards. Software Update keeps saying your Mac is up to date, because in a narrow sense it is: there is nothing left to install.

So the question "is my Mac still getting security updates?" has no official answer. It has an observable one, and it takes about a minute to check once you know where to look. This article is that check, plus what actually changes when the answer is no — which is less dramatic than the internet suggests, in a specific way that matters — and the one deadline worth knowing about before you spend money replacing anything.

The thing Apple does not do

It is worth being precise about the gap, because people assume they simply missed the announcement. They did not; there wasn't one.

Apple maintains a page called "Apple security releases" that lists every security update it ships, with the software name, what it is available for, and the release date. That page describes itself as a document that "lists security updates for Apple software" and nothing more. Search it for the words you would expect — end of support, end of life, no longer supported, unsupported — and you will find none of them. There is no lifecycle table, no retirement date, and no forward notice of any kind. The list records what Apple has already done, never what it plans to stop doing.

Apple's other relevant page makes the silence easier to see. "Find out which macOS your Mac is using" carries a table headed "Which macOS is the latest?", and it currently reads macOS 27 Golden Gate 27.0, macOS Tahoe 26 at 26.7, macOS Sequoia 15 at 15.8, macOS Sonoma 14 at 14.8.9, macOS Ventura 13 at 13.7.8, and on down through Monterey, Big Sur, Catalina and older. Every one of those has a "latest version" number sitting neatly in the right-hand column. Three of them are still being patched. The rest have been finished for anything from a month to a decade. Nothing in the table distinguishes them, because the table is answering a different question — what is the highest version number that exists — and a reasonable person reads it as a list of current things.

The nearest Apple comes to a statement about how long your Mac keeps getting updates is half a sentence on a hardware-service page: "Your product is supported by ongoing OS updates". That is a reassurance, not a commitment, and it carries no dates.

How to tell, in about a minute

The answer is visible in Apple's published record of what it has actually shipped, and the pattern has been consistent for years: at any given moment, exactly three versions of macOS receive security updates — the current one and the two before it. When a new major version arrives each autumn, the oldest of the three quietly stops.

You can watch it happen in this year's entries. On July 27, 2026, Apple shipped macOS Tahoe 26.6, macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8 — three versions, one day. On August 6 it did it again: Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9. Then on September 14 it released macOS Golden Gate 27, macOS Tahoe 26.7 and macOS Sequoia 15.8 — and Sonoma was simply not in the batch, nor in any batch since. Sonoma had become the fourth version back, and the fourth version back does not get updates.

So the check is this. Open the Apple menu in the top-left corner of your screen and choose About This Mac, which always shows the name and version number of the macOS you are running. Then count backwards from the current release. If you are on macOS 27, macOS Tahoe 26 or macOS Sequoia 15, you are being patched today. If you are on macOS Sonoma 14 or anything older, you are not, and you have not been since the summer.

The same rule tells you when your turn comes. Whatever version you are on, it stops getting security updates on the day the major release three versions later ships — in practice, an autumn, roughly two to three years out. Nothing will tell you on the day. It is simply the day your version stops appearing in the list.

Safari goes with it, and that is the part with teeth

Tucked into the same release list is a detail that decides how much any of this matters, and it is easy to miss because Safari is versioned separately from macOS.

Every Safari release on Apple's list names the macOS versions it is for. Safari 26.6, on July 27, 2026, was for "macOS Sonoma and macOS Sequoia". So was Safari 26.6.1 on August 18 — the last Safari update Sonoma ever received. Then came Safari 27 on September 14, and it is for "macOS Sequoia and macOS Tahoe". Sonoma is not on it and will not be on the next one either.

That matters more than a missing system patch, because the browser is the part of your computer that spends all day opening files written by strangers. A frozen Safari keeps whatever holes were open on its final day, permanently. If you are on an unsupported macOS and you are still using Safari, that is the single thing worth changing, and the next section explains why it is also an easy thing to change on a Mac.

What does not stop — and why a Mac is not a Chromebook here

The doom-laden version of this subject treats an unsupported computer as a dead computer, and on a Mac that is wrong in a way worth spelling out, because it changes what you should actually do.

On a Chromebook, the browser is the operating system. When the updates stop, the browser freezes with them and there is no way around it — which is why we treat an expired Chromebook as a machine to move your banking off. A Mac is not built that way. Safari ships with macOS and stops when macOS stops, but the other browsers are ordinary applications that update themselves, and they keep supporting macOS versions that Apple has long since finished with. Google's own system requirements for Chrome say plainly that to use Chrome browser on Mac, you need "macOS 13 Ventura and up" — two whole versions older than the oldest macOS Apple is still patching.

So an unsupported Mac still has a browser that is getting security fixes every few weeks, as long as you stop using Safari on it. That is a real and meaningful difference in kind, and it is why "keep the Mac, change the browser" is a legitimate answer here where it is not on a Chromebook.

Two things are still true, and it would be dishonest to skip them. Anything below the browser — the operating system itself, the network stack, the file handling, the PDF and image code that opens things you were sent — is no longer being fixed, and those do get attacked. And browser support runs out eventually too: Chrome's floor is Ventura today, and it will move up in time, at which point a machine loses its last updated component. The honest summary is that an unsupported Mac is on a slope rather than a cliff, and you have a couple of years of usable, reasonably-defended life to plan inside — not a week of panic, and not forever.

Microsoft's clock is bolted to Apple's, and it moves on the same day

If there is Office on the Mac, a second support window closes at the same moment, run by a different company, and this one is written down.

Microsoft's rule for Office for Mac is stated on its own documentation in exactly these terms: "Office for Mac is supported on the three most recent versions of macOS. As new major versions of macOS are made generally available, Microsoft removes support for the oldest version and support the newest and previous two versions of macOS." Read that carefully — it is not a schedule Microsoft controls. It is a rule keyed to Apple's release calendar, which means Microsoft's supported window moved on September 14, 2026 for the same reason Apple's did, and macOS Sonoma fell out of both on the same day.

A caveat that is itself instructive: Microsoft's consumer-facing page on this still says "As of September 2025, the three most recent major versions are macOS Tahoe (26), macOS Sequoia (15), and macOS Sonoma (14)." That list is a year out of date and has not been refreshed for macOS 27. The rule above it is the part that is load-bearing; the example underneath it is stale. We mention it because if you go and read that page yourself you will find a sentence that appears to say Sonoma is supported, and it is a snapshot with its own date on it rather than a current statement.

What actually happens if you stay put is stated plainly by Microsoft and is worth quoting, because it is the same shape as the Apple situation: "If you're on an unsupported version of macOS, your Office apps will still work but you would no longer receive any updates including security updates." Nothing switches off, nothing nags you, and the software quietly stops improving. Microsoft's history here shows the pattern running on schedule year after year — the September 2025 update was "the last build to support macOS Ventura (13)", and the August 2024 update was "the last build to support macOS Monterey (12)".

The four Macs that just ran out of road

Now the hardware half, which is the reason this particular autumn is different from the last several.

macOS 27 Golden Gate is the first macOS that will not install on any Intel Mac at all. Comparing Apple's two compatibility pages side by side gives the exact list of what was dropped between macOS Tahoe 26 and macOS 27, and it is four models: the MacBook Pro (16-inch, 2019), the MacBook Pro (13-inch, 2020, Four Thunderbolt 3 ports), the iMac (Retina 5K, 27-inch, 2020), and the Mac Pro (2019). That is the entire Intel fleet that made it as far as Tahoe, and it is now the entire Intel fleet that did not make it past it.

The headline is in those dates. The newest computers that macOS 27 refuses to install on are 2020 models — a 27-inch Retina 5K iMac and a 13-inch MacBook Pro — and the list also includes a Mac Pro, Apple's workstation tower. These are not ancient machines and several of them are still excellent. The line Apple drew is not about age or speed; it is about which processor is inside.

The mirror image is the reassuring bit, and it is why we are not telling most Mac owners to worry. Every Apple silicon Mac ever made is still on the macOS 27 list, right back to the first ones — the MacBook Air (M1, 2020), the MacBook Pro (13-inch, M1, 2020) and the Mac mini (M1, 2020). Apple's security-release entry for macOS 27 spells the rule out: it is available for "MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023)". Six years in, no Apple silicon Mac has been dropped from anything.

Which makes the first question about your own Mac an easy one. Apple menu, About This Mac: on an Apple silicon Mac the window shows an item labelled Chip followed by the chip's name, and on an Intel-based Mac it shows an item labelled Processor followed by the name of an Intel processor. Chip means you are fine for the foreseeable future. Processor means the rest of this article is about you.

If you have one of the four: what you actually have

An Intel Mac that runs macOS Tahoe 26 today is not out of support. It is on the second-newest macOS, which is currently getting security updates alongside the newest — Tahoe 26.7 shipped on the same September day as macOS 27 itself. Nothing about your machine changed when Golden Gate came out, except that it is now the last macOS your Mac will ever run.

How long that lasts follows from the three-versions pattern rather than from any Apple promise, so treat the following as an expectation and not a guarantee. Tahoe is version 26. It stays inside the supported three until macOS 29 arrives, and on Apple's recent once-a-year autumn cadence that points at roughly autumn 2028. In other words, a 2019 or 2020 Intel Mac has something in the region of two more years of security updates in it — and then the slope described above, with a browser that keeps going for a while longer.

That is a genuinely useful planning horizon, and it is very different from the advice these machines usually get. You are not replacing a computer this month. You are deciding, over the next year or two, whether to replace it at all, and you can spend that time doing the cheap things that make the decision easier later: get the backups actually working, note down which of your applications are old enough to be a problem, and — this is the one people skip — stop using Safari on it well before you have to.

The Terminal command that answers "what can this Mac still install?"

There is one more question that comes up constantly and has a precise answer built into macOS: if my Mac cannot have the newest version, what is the newest version it can have? People usually try to work this out from compatibility tables and model years, which is slow and easy to get wrong for a Mac that has been through a repair or a logic-board swap.

Apple publishes the direct method. Open Terminal, which lives in the Utilities folder inside Applications, and enter: softwareupdate --list-full-installers

Apple's own description of what that does is that it gets "a list of macOS versions that are currently available for your Mac model." It asks Apple, about the actual machine you are sitting at, and prints back what it will hand over. If you then want one of them, the companion command downloads the installer into your Applications folder: softwareupdate --fetch-full-installer --full-installer-version followed by the version number — Apple's own worked example uses 26.6.2. If Terminal answers that the update was not found, Apple says plainly that "that version of macOS is not available for your Mac".

One boundary worth knowing before you go hunting for something older: Apple states that this route downloads "compatible macOS versions no earlier than the version that came with your Mac, or the closest version still available." You can move forward and you can sometimes step back a little, but you cannot use it to put a much older macOS on a newer machine.

If Terminal is not your idea of a good evening, the same versions are reachable through the App Store, and Apple links installers for macOS Sequoia 15, Sonoma 14, Ventura 13, Monterey 12, Big Sur 11 and Catalina 10.15 from its own upgrade page. The command is just faster and it cannot lie to you about what your particular Mac will accept.

Before you replace an Intel Mac: the Rosetta deadline

This is the section we would most want an Intel Mac owner to read, because it affects a decision you are about to make with real money, and almost nothing written about the macOS 27 release mentions it.

The thing that has made moving from an Intel Mac to an Apple silicon Mac painless for six years is Rosetta — a translation layer that runs Intel-built applications on the new chips automatically, in the background, with nothing for you to configure. It is the reason your old accounting package, your scanner utility or your twelve-year-old photo editor kept working after you switched. Apple has now put a horizon on it, in plain consumer language on its own support page: "Rosetta is available for any Mac with Apple silicon using macOS 27 or earlier. Starting with macOS 28, the next major macOS release, Rosetta functionality will be available only for certain older, unmaintained games that rely on Intel-based frameworks."

Read that against the calendar and the squeeze is obvious. macOS 28 is the next annual release. So somebody buying a Mac today to replace an Intel machine gets the full translation layer for about a year, and then only for a narrow category of old games. Any application you rely on that has never been rebuilt for Apple silicon has roughly that long — and the applications most likely to be in that position are exactly the ones a long-time Intel Mac owner has: niche, specialised, expensive, and from a small developer or one that has moved on.

Apple has also put a notice in the way, which is how many people will first hear about this: "When opening an Intel-based app, you might be notified that support is ending for Intel-based apps, and that the app or a component used by the app will not work with a future release of macOS (macOS 28)."

You can find out where you stand before you buy anything, and it takes a few minutes. Apple gives two methods. In the Finder, select an application in the Applications folder, press Command-I for Get Info, and read the line after "Kind:" — "Application (Intel)" is one that needs replacing, while "Application (Universal)" or "Application (Apple silicon)" is fine. And on a Mac already running macOS 27, there is now a list built in: Apple menu, System Settings, General in the sidebar, About on the right, then the Details button next to "Intel-based Apps", which shows the Intel applications you have recently used or that are installed in the usual places.

The check that saves the money is doing this on your current Mac, in advance, and then finding out for each Intel-only application on the list whether an Apple silicon version exists, costs money, or does not exist at all. Apple notes the trap inside the trap too: an application can be Universal and still depend on Intel-only "plug-ins, extensions, or other add-ons" from a different developer, which have to be updated separately. That is the scenario where a new Mac arrives and something important still does not work — and it is much cheaper to discover it the week before than the week after.

"Vintage" and "obsolete" are about parts, not updates

A quick clarification, because these two words send people into a spin and they are measuring something else entirely.

Apple classifies hardware as vintage or obsolete for the purposes of repair. Its rule: products are "considered vintage when Apple stopped distributing them for sale more than 5 and less than 7 years ago", and "obsolete when Apple stopped distributing them for sale more than 7 years ago", at which point Apple "discontinues all hardware service" and "service providers cannot order parts". Mac laptops can still qualify for a battery-only repair period of up to ten years, subject to parts being available.

Three things follow. That clock starts when Apple stopped selling the model, not when you bought it — so a machine bought late in its run is further along than its owner assumes. It governs whether a broken part can be replaced, and has nothing to do with whether the software is being patched. And the two systems genuinely do run independently: a Mac can be getting security updates and be unrepairable, or be perfectly repairable and unpatched. If what you are worried about is a failed screen or battery, vintage and obsolete are your words. If what you are worried about is security, they are not.

What we would actually change on an unsupported Mac

Assume the check came out badly — you are on Sonoma or older, or you are reading this in 2028 with a Tahoe-locked Intel machine. Here is the split we use, and it follows from what is and is not still being patched rather than from a general sense of unease.

Change the browser first, and mean it. Install Chrome or Firefox, make it the default, and stop opening Safari — including the habit of clicking links in Mail, which will keep using whatever the default is. This is the single highest-value thing on the list, it is free, it takes ten minutes, and on an unsupported Mac it restores the one component that faces the internet all day to being actively maintained.

Move the highest-stakes sessions to a supported machine if you have one: online banking and brokerage, filing taxes, anything where you type a card number, and signing into the primary email account that all your password resets flow through. Not because the Mac will be robbed tomorrow, but because those are the sessions where a flaw below the browser actually pays off for somebody, and you almost certainly have another device in the house for them.

What is genuinely fine, and we would rather say so than see a working computer thrown away: writing, email on a secondary account, photos, music, streaming, video calls, spreadsheets, printing, scanning, and the long tail of things a Mac quietly does well for a decade. An unsupported Mac used sensibly is a better machine than most new cheap laptops.

Two things sharpen the middle ground. Turn on two-step verification for every account that signs in on that machine, because that is the protection that still works when the device is not being patched. And get the backup genuinely working and tested — an older machine is exactly where a drive failure is most likely and least expected, and that risk has nothing to do with software support at all.

One thing we would not do: go looking for a tool that forces a newer macOS onto an unsupported Mac. These exist, and people do run them. But they work by modifying the system, they break in unpredictable ways at each new release, and they tend to put the Mac in a state where the next problem is very hard to diagnose and Apple's own recovery tools are not much help. On a machine that somebody actually depends on, the version Apple will give you and a browser that is still updated is the better trade.

The short version

Apple publishes no end-of-support date for macOS and will not notify you when yours arrives. The rule you can observe on Apple's own release list is that three versions get security updates at a time — today macOS 27, macOS Tahoe 26 and macOS Sequoia 15. macOS Sonoma 14 stopped on August 6, 2026 and nobody was told. Check yours in the Apple menu under About This Mac and count.

macOS 27 Golden Gate, released September 14, 2026, is the first macOS with no Intel support at all. Four models were dropped: the MacBook Pro (16-inch, 2019), the MacBook Pro (13-inch, 2020, Four Thunderbolt 3 ports), the iMac (Retina 5K, 27-inch, 2020) and the Mac Pro (2019). If yours is one of them it stays on Tahoe 26, which on the current pattern should keep getting security updates into roughly autumn 2028 — so this is a planning problem, not an emergency.

If you are on an unsupported version, stop using Safari and switch to a browser that still updates itself — Chrome currently supports macOS 13 Ventura and up, far below Apple's floor. And if there is Office on the Mac, Microsoft supports the three newest macOS versions and drops the oldest on the day Apple ships a new one, so that window closed on the same date.

Before you buy a replacement, check which of your applications are Intel-only, because Rosetta covers macOS 27 and then narrows to certain old games in macOS 28. Command-I on an application and read the line after "Kind:". Finally, "vintage" and "obsolete" are about whether parts can be ordered, not about updates — different clock, different question.

How we can help

Most of the above is a check and a decision, and plenty of people can work through it from here. Where it gets worth a hand is where money or data is on the line: working out honestly whether a 2019 or 2020 Intel Mac is worth keeping for another two years or replacing now, auditing which applications on it are Intel-only and what the Apple silicon versions cost before you commit to a new machine, and doing the migration so that mail, photos, documents and printer setups actually land on the other side.

We also do the unglamorous half that decides whether any of this goes well — getting a backup that has been tested by restoring something rather than just reporting green, moving a household off Safari on the machines where that matters, setting up two-step verification on the accounts that sign in on an older computer, and safely wiping and signing out of a Mac before it is sold, handed on or recycled.

We look after Macs and PCs for households and small businesses across Southern California and the Coachella Valley, onsite or by remote support. Because we do not sell computers, the advice about whether to replace one stays independent — and if you want a rough second opinion before you call anyone, our repair-or-replace calculator is a quick place to start.