Apple is deprecating hdiutil in macOS 27 Golden Gate. Are your scripts ready?

Arek Dreyer

• August 28, 2026

Apple is deprecating hdiutil in macOS 27 Golden Gate. Are your scripts ready?

If you spent part of last weekend fielding Slack messages about hdiutil, you're not alone. Jeff Johnson's lapcatsoftware.com blog flagged that the man page for hdiutil in the macOS 27 Golden Gate beta now carries a deprecation notice:

"In macOS 27.0, hdiutil is deprecated. Use diskutil image instead for all disk image operations."

Because the hdiutil tool to manipulate disk images has been widely used by Mac admins for so many years, it’s worth a second look. Here's the short version.

Deprecated today doesn't mean gone today

Apple's own release notes distinguish between hdiutil and diskutil. For now, hdiutil still works. Using it in a script won't break anything in macOS 27, though depending on how you're invoking it, your users may start seeing deprecation warnings surface. Nothing about current functionality goes away in the release of macOS 27.

That's an important distinction, because "deprecated" and "removed" can get used interchangeably in the panic that follows a weekend blog post, and they're not the same thing. What it does mean is that Apple has told developers and admins where things are heading, and that diskutil image (which handles attach, create, resize, info, and chpass) is the intended long-term replacement.

Why this shows up on so many admin scripts

hdiutil has been the standard way to create and manipulate disk images (.dmg files) since early Mac OS X (as it was called then), so it's baked into a lot of custom tooling: packaging workflows, app distribution scripts, backup routines, anything that builds or mounts a disk image as part of a device management process. A single org-wide code search for hdiutil at most companies with any Mac-admin history is likely to turn up more hits than you'd expect.

That's also exactly why Apple deprecating (rather than yanking) the command matters. It gives teams a window to find every reference before it's a fire drill.

diskutil image isn't a 1:1 swap yet

Early testing referenced in the lapcatsoftware.com post is worth flagging before you start migrating scripts wholesale. Comparing the two tools on the same backup task, the author found diskutil image was noticeably faster, but also noted some gaps worth testing for in your own environment, like differences in verbose logging output, how (or whether) authentication prompts are triggered when a script hits permission issues, and support for options like hdiutil's -scrub, which controls whether temporary files and trash get included in an image. None of this is disqualifying, but it means "just swap the command name" probably isn't going to be your migration plan.

What to actually do about it

Apple has trimmed CLI tooling before without much warning. As we covered around WWDC, some legacy MDM commands were removed outright in macOS 27 with no deprecation runway at all. hdiutil is, at least, getting the more generous treatment. Here's how to spend that runway before it closes:

Search your scripts, packages, and app distribution tooling for hdiutil references.
Test the equivalent diskutil image subcommands against your actual workflows in the macOS 27 beta, not just the happy path.
File Apple Feedback on any gaps you hit. For example, diskutil lacks the equivalent of hdiutil’s -puppetstrings option, but if you file feedback with Apple about how this impacts your workflows and is a blocker for you, it’s more likely that Apple will address it (in other words, don’t just boo.)
Track this the same way you'd track any other beta-cycle compatibility item, so it's resolved well before hdiutil functionality actually goes away in a future release.

There's no need to treat this as an emergency. There is a good reason to treat it as homework.

How Iru fits in

If you're running this audit against macOS 27 beta devices, Iru's Managed OS and ADE Library Items support enforcing Apple beta enrollment and specific beta releases, so you can put a real test population on Golden Gate without touching production devices. See our recent post on Apple beta testing for how to set that up.

Rustbot, the macOS malware used in the latest Rust Supply Chain Attack

On August 20, 2026, attackers published malicious versions of three widely used Rust packages to crates.io, the official Rust package registry. On macOS, the payload is a remote access trojan (RAT) that collects cloud credentials, SSH keys, cryptocurrency wallet data, and browser profile information, then sends it to attacker-controlled infrastructure. It installs a launch agent to survive reboots and accepts follow-on commands from its operators. Once running, it decrypts its configuration, profiles the host, Reads the local browser stores, installs persistence via LaunchAgent, and beacons out. The packages were available for approximately two hours before removal. The attackers also withdrew the previous stable versions, which pushed automated dependency resolution toward the compromised releases. Any environment that compiled an affected project during that window should be treated as compromised. This blog documents Iru's analysis of the native Apple Silicon ARM64 implant.

Threat Intelligence September 3, 2026

Csaba Fitzl • 6 min read

Inside the screensharingd Bugs: How macOS Screen Sharing Went from Root File Access to Pre-Auth Compromise

In late July 2026, a cluster of vulnerabilities in macOS Screen Sharing turned what initially looked like a fairly constrained privilege problem into one of the more interesting macOS remote-attack stories in years.

Threat Intelligence September 1, 2026

Mike Boylan • 6 min read

Apple beta testing and device management services: the perfect match

Every fall, Apple’s newest operating systems arrive everywhere at once. That’s great for users, but it puts IT teams on the clock: they need to validate the release, find blockers, prepare their support teams, and decide when the business is ready to move.

Educational August 19, 2026