Enlarge (credit: Getty Images )

End users, admins, and researchers better brace yourselves: The number of apps being patched for zero-day vulnerabilities has skyrocketed this month and is likely to get worse in the following weeks.

People have worked overtime in recent weeks to patch a raft of vulnerabilities actively exploited in the wild, with offerings from Apple, Microsoft, Google, Mozilla, Adobe, and Cisco all being affected since the beginning of the month. The total number of zero-days in September so far is 10, compared with a total of 60 from January through August, according to security firm Mandiant. The company tracked 55 zero-days in 2022 and 81 in 2021.

The number of zero-days tracked this month is considerably higher than the monthly average this year. A sampling of the affected companies and products includes iOS and macOS, Windows, Chrome, Firefox, Acrobat and Reader, the Atlas VPN, and Cisco’s Adaptive Security Appliance Software and its Firepower Threat Defense. The number of apps is likely to grow because a single vulnerability that allows hackers to execute malicious code when users open a booby-trapped image included in a message or web page is present in possibly hundreds of apps.

Enlarge (credit: Apple)

While new iOS releases always come out in September, Mac owners usually need to wait nearly a month to get the same improvements for their laptops and desktops. But the wait will be much shorter this year—Apple says that macOS 14 Sonoma will be available on September 26, just over a week after iOS 17 releases to the public on September 18 . It will be the first update since 2018's Mojave to release in September rather than October.

A longer gap between releases can occasionally make things awkward for people who like to update on day one, since Apple sometimes adds new features to iCloud-connected apps like Notes, Reminders, and Photos that will only work in the latest OS releases. A shorter gap between releases will reduce that kind of awkwardness.

Sonoma is generally a low-key release, but it does include a few headlining features , including desktop widgets that can sync with your iPhone. A new Apple-made Game Porting Toolkit will make it easier for Windows game developers to get their titles up and running on Macs. Better screen sharing, revamped screen savers, an improved password manager, and a few other additions flesh out the update.

Enlarge / Apple's 15-inch MacBook Air. (credit: Andrew Cunningham)

For most of the last year, the rumor mill has indicated that the first wave of Apple’s M3 Macs will be hitting sometime this fall —perhaps in October, a month Apple has often used for iPad and Mac announcements that can’t be crammed into its iPhone and Apple Watch-focused product events in September.

But according to reliable Apple analyst Ming-Chi Kuo, the company won't launch those models before the end of the year . Kuo didn't share specifics, but he has sources inside Apple's manufacturing supply chains that often give him reliable information about the company's plans.

Apple's timing shifted similarly last year when M2-based MacBook Pro and Mac mini designs that were apparently intended for late 2022 launched in January 2023 instead.

Enlarge (credit: Apple)

Apple has released security updates for iOS, iPadOS, macOS, and watchOS today to fix actively exploited zero-day security flaws that can be used to install malware via a "maliciously crafted image" or attachment. The iOS 16.6.1, iPadOS 16.6.1, macOS 13.5.2, and watchOS 9.6.2 updates patch the flaws across all of Apple's platforms. As of this writing, no updates have been released for older versions like iOS 15 or macOS 12.

The CVE-2023-41064 and CVE-2023-41061 flaws were reported by the Citizen Lab at the Munk School of Global Affairs & Public Policy at the University of Toronto. Also dubbed "BLASTPASS," Citizen Lab says that the bugs are serious because they can be exploited just by loading an image or attachment, which happens regularly in Safari, Messages, WhatsApp, and other first- and third-party apps. These bugs are also called "zero-click" or "clickless" vulnerabilities.

Citizen Lab also said that the BLASTPASS bug was "being used to deliver NSO Group’s Pegasus mercenary spyware ," the latest in a long line of similar exploits that have been used to infect fully patched iOS and Android devices.

Enlarge / You can now use Touch ID to log in to your Windows virtual machine. (credit: Parallels )

It's an annual tradition to see an update to Mac virtualization software Parallels Desktop a few weeks before the next major macOS release. Like clockwork, we've come to that time again: Parallels Desktop 19 is available now, with a handful of improvements for users who want to run Windows or Linux on their Macs.

It's not the most radical year-over-year update we've seen, but there are some welcome optimizations and tweaks. The headlining feature is the ability to use Touch ID to sign in to your Windows virtual machine. When you next launch your Windows VM, your Windows password can be saved to your Mac's keychain with a Touch ID-specific record that is unique to your device. It's important to note that this is just for signing into the VM, though; this is not full Touch ID support for all the places Windows Hello appears throughout Microsoft's operating system.

There are also various tweaks to make Parallels macOS Sonoma-ready, what with Apple's annual OS update coming sometime this fall. For example, a change in Sonoma would have broken the Shared Printing feature that allows you to print from your Windows VM. Parallels' engineers re-configured the feature to get it working within the new release and made some improvements to it.