Computer Repair · November 6, 2026 · ComputerKing Team

Your Mac Says It's Up to Date, but Its Malware Definitions May Have Gone Stale: Sequoia 15.8 XProtect Update Failure Check

XProtect, the malware detection built into macOS, should normally get new rules almost every week. But checks in early November 2026 found that on Sequoia 15.8 to 15.8.2 the update command fails, reporting no update even when one exists. This guide shows how to check your own Mac, what you can do now, and when to worry.

Key points

XProtect is the first line of macOS's built-in defence against malware, part of Gatekeeper's checks, and Apple updates its detection rules almost every week — a healthy Mac should install them within 24 hours of release. But checks on 3 November 2026 found that Macs running Sequoia 15.8 to 15.8.2 hit a Code 11 error with `xprotect check`, and `xprotect update` reports no update available even when a new set of rules exists. The evidence points at Apple's iCloud servers, not your Mac. Tahoe and Golden Gate users are not affected. This guide shows how to check, what you can do now, and what not to do. Individual quotation required for any service.

1. What XProtect is: a line of defence your Mac runs quietly

Many Mac users have never heard of XProtect, but it works every day: it is the malware detection built into macOS, part of Gatekeeper's checks, scanning apps and other executable code against a large set of detection rules to recognise known malicious software. Apple updates those rules almost every week to keep up with new threats, and a healthy Mac should install them within 24 hours of release.

Since Sequoia 15, the rules live in two copies: the primary copy in `/var/protected/xprotect`, updated via iCloud, and a secondary copy in `/Library/Apple/System/Library/CoreServices`, updated through the traditional Software Update service. macOS has an `xprotect` command tool that can check the installed version, check what is available from iCloud, and force an update of the primary copy:

• `xprotect version`: shows the version currently installed in the primary location.
• `sudo xprotect check`: shows the version currently available from iCloud.
• `sudo xprotect update`: downloads any newer version from iCloud and installs it in the primary location.

Ordinary users never need these commands, because updates should happen automatically in the background. The problem is when that automatic route breaks silently, and you do not know — the machine keeps guarding new threats with old rules.

2. What is happening now: the update command fails on Sequoia 15.8

As of 3 November 2026:

• macOS Golden Gate 27.0–27.2: all three `xprotect` commands work as expected.
• macOS Tahoe 26.x–26.7.2: all three `xprotect` commands work as expected.
• macOS Sequoia 15.8–15.8.2: only `xprotect version` works as expected. `xprotect check` consistently returns "Got error checking for update: Error Domain=XProtectUpdateError Code=11". `xprotect update` consistently reports that no update is available, even when one is.
• macOS Sequoia 15.6.1: all three `xprotect` commands work as expected.

In other words, the users affected are the ones who did the right thing — kept up with security updates and stayed on Sequoia 15.8. This problem also appeared during the Golden Gate beta phase and shortly after the 27.0 public release, then disappeared; it has now reappeared on Sequoia 15.8.

3. Why it happens: the evidence points at the server, not your Mac

Comparing log entries from machines on different versions, the clearest differences are in responses from the iCloud server, which consistently returns an error 48 and a failure to "fetch some records" — specifically, the record zone for Sequoia 15.8 "does not exist." The conclusion is that a persistent bug is currently preventing updated versions of macOS Sequoia from updating XProtect in its primary location, with indications that it is occurring in iCloud servers rather than in local macOS.

That conclusion matters, because it decides what you should not do: reinstalling the system, clearing caches or resetting settings are local measures, and they will not fix a server-side problem. Do not try them.

4. How to check your own Mac: two steps is enough

1. Check which macOS version you are running. Apple menu at the top left, then "About This Mac." Tahoe or Golden Gate means you are not affected by this issue; Sequoia 15.8 or 15.8.2 means you are in the affected range; 15.6.1 or older means you are not affected. The version is the key to the triage.

2. If you use Terminal, run `xprotect version` to see the rules version installed. If you do not use Terminal, that is fine — step 1 is what matters. Do not copy sudo commands of unknown origin from the internet to "force a fix" — a command from an untrusted source is itself a risk, and this issue is not fixed by running commands repeatedly.

5. What you can do now: three things, and nothing extra

• Update the secondary copy via Software Update or SilentKnight. Utilities like SilentKnight alert you when new rules are released, and can help get the secondary copy updated.
• Then wait. A periodic background service, XProtectUpdateService, will use the updated secondary copy to update the primary location — but that can take a day or more, and it cannot be forced with `xprotect update`.
• Do not do the following: do not keep re-running `xprotect update` — on affected versions it does nothing useful; do not install a "Mac cleaner / antivirus" app of unknown origin because of this; do not downgrade macOS.
• Some reassurance: XProtect is only one layer. Gatekeeper, where you choose to download apps from, and not opening unknown attachments are all still working. Stale rules do not mean zero protection — but they are not something to ignore either.

6. When to get help

If you suspect the Mac is already infected — for example, the browser keeps redirecting to strange sites, programs you do not recognise have appeared, or the machine has become slow and hot for no reason — that is not an XProtect update problem, it is a different matter. Stop, do not keep experimenting, and get help.

Before asking for help, prepare:

• The macOS version, and the result of `xprotect version`.
• Any apps installed recently, and where they were downloaded from.
• When the symptoms started, and what you have already tried.

On pricing: this article gives no prices. Actual charges require an individual quotation, depending on the Mac model, version and the work involved.

Sources

• Eclectic Light report: Why your Mac may struggle to update XProtect (4 November 2026): https://eclecticlight.co/2026/11/04/why-your-mac-may-struggle-to-update-xprotect/
• Article 71 on this site, macos-sequoia-tahoe-security-updates-stay-put-guide: staying on Sequoia or Tahoe and still getting security updates
• Article 58 on this site, macos-full-disk-access-ai-agents-permission-check: checking Full Disk Access permissions on a Mac
• Article 144 on this site, macos-27-2-security-update-verify-installed-guide: macOS 27.2 security fixes overview

Related articles

• macos-sequoia-tahoe-security-updates-stay-put-guide
• macos-full-disk-access-ai-agents-permission-check
• macos-27-2-security-update-verify-installed-guide