Homebrew 7.0.0 gets built-in GUI, better security controls September 14, 2026 Homebrew package manager version 7.0.0 has been released with a built-in vulnerability scanner, stronger security controls, and the full release of its native BrewUI graphical interface. The open-source package manager is primarily used on macOS, allowing users to install software in a similar way to Linux package managers by automatically downloading packages and resolving and installing their dependencies. The popularity of the project is obvious from its 49k stars and 11k forks on GitHub and from threat actors frequently targeting it to push info-stealer malware , including through clone sites and ClickFix lures . In the latest version, the BrewUI official native graphical interface available on macOS 26 “Tahoe” and later makes it easy to browse and search for packages, as well as inspect and manage their dependencies. Users can now use the vulnerability scanner through a new command (brew vulns). Also included is a Homebrew-specific advisory database that tracks vulnerabilities affecting the formula versions and revisions distributed by Homebrew. Homebrew manages “casks,” which are used to install graphical applications, fonts, plugins, and other macOS software, and formulae , which are Ruby-based package definitions that can instruct Homebrew to download files, run build commands, or install dependencies. Homebrew 7.0.0 adds a scanning command that can check installed formulae, a specific one, or formulae and their dependencies declared in a Brewfile. For each formula, Homebrew determines the upstream software repository and its version/tag, while for installed packages, it uses information from the available SBOM or derives the source from the formula definition. The command sends the upstream repository and version/tag to OSV.dev in a batch query, retrieves the vulnerability records, verifies potential matches, applies optional severity filters, and finally checks whether Homebrew has already applied a security patch to this formula. Separately, Homebrew’s new advisory database publishes OSV-format records documenting vulnerabilities affecting Homebrew formula versions and revisions, including fixes that have been backported without changing the upstream software version. “Homebrew publishes advisory findings in the formula API and a downloadable advisory index, helping other tools distinguish outstanding vulnerabilities from fixes already shipped,” the project team explains . “The database’s OSV-format records are freely reusable under CC0, giving security teams a shared source of Homebrew-specific vulnerability data.” Users also get better sandboxing in Homebrew 7.0.0 as access to users’ home directories is blocked by default and network-enabled dependency downloads are separated from offline installation. Homebrew also notes that installations and upgrades are faster in the new release, thanks to a new ability to download, prepare, and install packages concurrently. Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Related Articles: Empty npm package '-' has over 700,000 downloads — here's why Surfshark VPN says hackers breached internal testing, proxy servers Coder's registry infrastructure compromised to push malicious modules Brave browser adds email aliases to help users evade tracking

New Infinity Stealer malware grabs macOS data via ClickFix lures Vulnerability Scanner Previous Article Not a member yet? Register Now You may also like: Microsoft releases emergency Windows updates to fix RDS failures Microsoft releases emergency Windows updates to fix RDS failures Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent Microsoft: September updates cause RDS failures on Windows Server Microsoft: September updates cause RDS failures on Windows Server Overdue a password health-check? Audit your Active Directory for free Overdue a password health-check? Audit your Active Directory for free Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday. Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday. Patch automation needs more than speed. Action1 brings control into every stage of deployment. Patch automation needs more than speed. Action1 brings control into every stage of deployment. Watch a working exploit hit live controls and see exactly what blocks, detects, or misses Watch a working exploit hit live controls and see exactly what blocks, detects, or misses Find your gaps before an auditor does. Check your EU CRA readiness in 5 questions. Find your gaps before an auditor does. Check your EU CRA readiness in 5 questions. EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain