Back Feeds2.Feedburner

Homebrew tightens tap security, begins work on its interface

Feeds2.Feedburner •Anamarija Pogorelec • June 18, 2026

Anyone who installs software through a third-party Homebrew tap runs Ruby code written by people outside the project, and that code runs without a sandbox. That risk sits at the center of Homebrew 6.0.0. Tap trust Homebrew now requires a tap, along with any tap-qualified formula or cask, to be trusted before its code is evaluated or run. The official Homebrew taps stay trusted by default. The brew tap command gains options for managing trust … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Homebrew 6.0 Enhances Security with Tap Trust and Linux Sandboxing Homebrew has released version 6.0, introducing a new tap trust mechanism that requires explicit trust for third-party taps, enhancing supply chain security. This version also adds Linux sandboxing for compiling software, a feature already present on macOS. The update aims to mitigate risks associated with running untrusted Ruby code from third-party sources. Homebrew's project lead highlighted the importance of these changes, noting that the trust model is significantly different from npm's. Additionally, a new command, brew vulns, allows users to check for known vulnerabilities in installed packages. Homebrew is phasing out support for Intel macOS, with no new bottles for Intel starting September 2026. The update is well-received among developers, although some express frustration over the transition. 4 sources 43

Homebrew tightens tap security, begins work on its interface

The full story

Extracted Entities

MITRE ATT&CK (1)

Platforms (2)