# IT Digest – September 14, 2026

> Sep 14, 2026 · #apple #security #cloud

macOS 27 launches today, a phishing wave hits Microsoft 365 via a fake passkey helpdesk, and CISA adds a critical ScreenConnect flaw.

## 1. macOS 27 "Golden Gate" launches today — the new AI features need a newer Mac

Apple is releasing macOS 27, codenamed "Golden Gate," today for all Apple Silicon Macs from 2020 onward. It brings a standalone, overhauled Siri app, natural-language-driven Shortcuts, an AI tool for building extensions for developers, and Safari improvements. The most advanced AI features of the new Siri, however, require an M3 chip or newer and at least 12GB of RAM — older company Macs won't get them.

> **Why it matters:** a major macOS release is always a compatibility test for business software (VPN clients, EDR, print drivers). We recommend testing the update on one or two machines before rolling it out across your whole Mac fleet. If you're planning a hardware refresh for the AI features, budget for an M3 chip or newer.

## 2. A fake "IT helpdesk" tricks employees into setting up a passkey — and takes over their Microsoft 365 account

Security researchers are warning about a large-scale vishing/phishing campaign that has targeted finance and IT staff since May. The victim gets a call or SMS from a fake "IT helpdesk" urgently asking them to set up a new passkey, but the link leads to a spoofed Microsoft sign-in page. Through an adversary-in-the-middle or device-code flow, the attacker takes over the account and immediately adds their own authentication method — keeping access even after a password change. They then pull files from SharePoint and OneDrive via the Microsoft Graph API.

> **Why it matters beyond large enterprises:** attackers specifically target ordinary SMBs running Microsoft 365 with a small IT team, where one convincing phone call can compromise the entire company cloud. Employees need to know clearly that IT will never send a link to set up a passkey or MFA via SMS or a phone call, and that they should verify a caller's identity by calling back a known number.

## 3. CISA adds a critical ScreenConnect flaw to its actively exploited list

CISA expanded its Known Exploited Vulnerabilities (KEV) catalog with five new flaws. The most severe is CVE-2026-84869 (CVSS 9.9) in ConnectWise ScreenConnect, a popular remote-support tool, which allows file transfer and execution without any authentication. It's joined by critical flaws in MikroTik RouterOS and JFrog Artifactory, which attackers are already chaining together to install backdoors and gain administrator access.

> **Why it matters:** remote-management tools like ScreenConnect are used by many IT companies and internal IT departments for exactly what we use them for too — remote client support. If you run a similar tool, check today whether you're on a patched version; an unpatched RMM tool is a direct path for an attacker to reach all of your clients at once.

---

© 2026 ITself s.r.o. · Standard page: https://itself.sk/blog-en/2026-09-14-it-daily-roundup.html