Apple changed mBoot firmware inside macOS Sequoia 15.7.9 and Sonoma 14.8.9 (August 31, 2026)
Chapters
What is new on August 31
The discrepancy first surfaced three days earlier in reader comments, which I covered in the August 28 post. On that date it was a report and a plausible explanation. What August 31, 2026 adds is proof and a conclusion.
The author reproduced it deliberately: fresh Sequoia and Sonoma virtual machines, created clean, then updated to 15.7.9 and 14.8.9 after August 17, 2026. Both received mBoot 18000.161.10, the firmware that had previously shipped only with macOS Tahoe 26.6.2. The same updates installed on August 7, 2026 had delivered 18000.161.9.
The conclusion is stated plainly: "The inevitable conclusion is that there is no longer a direct relationship between macOS version and its mBoot firmware version, and that the latter can change unpredictably when a macOS update is installed." The author's summary of the mechanism is blunter: "Apple has effectively changed the updater in complete silence, leaving users to wonder why two Macs running the same version and build numbers of macOS can have two different mBoot firmware versions."
TL;DR
Apple repackaged the macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9 security updates without changing their build numbers, so two Macs reporting the same macOS version and build can carry different mBoot firmware, reproduced and published by The Eclectic Light Company on August 31, 2026. A Mac updated on August 7, 2026 received mBoot 18000.161.9; a Mac updated on August 28, 2026 received 18000.161.10, the firmware that had shipped with macOS Tahoe 26.6.2 on August 17, 2026. Apple issued no announcement, no revised build number and no mention in its security release notes, so any check that compares the firmware it found against the firmware a build should carry now reports mismatches that are not faults.
- The affected releases are macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9, with no build-number increment to signal the change.
- Install date decides the firmware: before macOS Tahoe 26.6.2 shipped you got mBoot 18000.161.9, after it you get 18000.161.10.
- It was reproduced in clean Sequoia and Sonoma virtual machines updated after August 17, 2026, which both received .10.
- There is no workaround. A Mac sitting on 18000.161.9 cannot be moved to .10 until the next macOS update.
- Verbatim from the August 31, 2026 write-up: "There has been no mention of any such change in Apple's security release notes."
Why the divergence became visible now
Sequoia and Sonoma had no updates at all between May 11, 2026 and July 27, 2026. That long gap is what made the change detectable: when the August security updates landed, the firmware they carried could be compared against a stable baseline rather than against a moving one.
On August 28, 2026 the same author described the situation as "even more of a mess than I had realised" and gave the currently supported mBoot versions as 18000.161.9 for Sequoia and Sonoma or 18000.161.10 for Tahoe. Three days later that pairing no longer holds, because Sequoia and Sonoma machines updated late are on .10 as well.
For an administrator this is the whole of the damage. You cannot derive an expected firmware version from a macOS build number any more, so a firmware-integrity check that compares found against expected produces a mismatch on a perfectly healthy Mac.
The firmware, by install date
These are the install dates actually published. The dividing line is the release of macOS Tahoe 26.6.2 on August 17, 2026, which is where mBoot 18000.161.10 originated.
| When the update was installed | mBoot firmware delivered | Releases involved |
|---|---|---|
| August 7, 2026, before macOS Tahoe 26.6.2 shipped | 18000.161.9 | macOS Sequoia 15.7.9, macOS Sonoma 14.8.9 |
| August 28, 2026, after macOS Tahoe 26.6.2 shipped | 18000.161.10 | macOS Sequoia 15.7.9, macOS Sonoma 14.8.9 |
| August 17, 2026, on release day | 18000.161.10 | macOS Tahoe 26.6.2 |
The other Mac behaviour published the same day
August 31, 2026 carried a second Mac story worth knowing about, reported by Michael Tsai on August 31, 2026. macOS Data Protection Classes A to D make protected files unreadable once the Mac is locked: "A few seconds after the screen locks (or you log out), the keys are purged."
Dave Nanian of Shirt Pocket puts the consequence for backups directly: "That means the files any application considers to be worth protection cannot be accessed when a backup usually happens." Both SuperDuper and Time Machine then have to run a follow-up pass after you unlock the Mac, and that pass can take 30 minutes or more where a fast incremental update used to do.
The published workaround is to schedule backups while you are actively using the Mac, which contradicts how almost everybody schedules backups. It is a real trade, not a fix.
What you can do today
1. Stop treating the macOS build number as a predictor of firmware. If you keep a firmware baseline for a set of Macs, record the version each Mac actually reports, alongside the date its last macOS update was installed.
2. If a firmware check flags a mismatch on macOS Sequoia 15.7.9 or macOS Sonoma 14.8.9, check the install date against August 17, 2026 before treating it as a fault. A Mac updated after that date is expected to be on 18000.161.10.
3. Do not try to force the newer firmware onto an older install. No method has been published, and a Mac on 18000.161.9 stays there until the next macOS update arrives.
4. Do not expect Apple documentation to settle it. The change appears nowhere in the security release notes as of August 31, 2026, so your own inventory is the only record you will have.
5. If your backups have become slow rather than wrong, test the other item above: run one while you are logged in and using the Mac, and compare how long it takes against an overnight run.
Frequently asked questions
Is a firmware mismatch on macOS Sequoia 15.7.9 a sign my Mac is compromised?
Not on its own. As of August 31, 2026, a Mac on macOS Sequoia 15.7.9 can legitimately carry either mBoot 18000.161.9 or 18000.161.10 depending on when the update was installed, so the comparison that used to prove tampering now proves nothing by itself.
Which macOS versions are involved?
macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9 are the repackaged updates. macOS Tahoe 26.6.2, released August 17, 2026, is where mBoot 18000.161.10 first shipped.