Three security tools on the Mac arrived with quiet changes this week, and only one of them came with a reason attached.
Signatures jump two builds
Apple pushed fresh definitions to both XProtect components on October 21. The scanner moved to build 5368, and the cleanup tool, XProtect Remediator, reached 170. Howard Oakley, who tracks the components weekly at The Eclectic Light Company, logged nine new Yara entries.
Five of those cluster around two families. CHEEKYCOBRA picked up a pair of rules, and FLUSTEREDFLAMINGO took four, one for each letter code. TIMELYTURTLE gained two more, SHADYSHOELACE one, and the older DUBROBBER rule was pulled out entirely. In XPScripts.yr, which holds AppleScript detections, one entry appeared for MACOS.OSASCRIPT.SHCUPA and three existing names were rewritten.
The Remediator side lost its DubRobber scanner in the same rollout, matching that retired Yara rule. Bastion behavioural rules went untouched. Distribution ran through iCloud, so Sequoia and later installs pick it up with no user action and no reboot prompt, and nothing is published explaining what prompted any of it.
Local network settings finally get an exit
The second change has a date rather than a build number. Local Network privacy, added in Sequoia, has shipped without a way to remove an app from its list; once an application appeared there, owners could only flip it on or off. Golden Gate 27.2, due next week, adds removal.
That control is unusual under the hood. It runs as a packet filter through Network Extension, not through the consent database governing camera and microphone access, which is why the reset took two releases. Terminal commands, Safari and Bonjour services such as AirPlay stay exempt.
Third, the XProtect app still fails to open on its own, by double click or in XProCheck. Checking build numbers stays a Terminal job.
