Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

macOS command-line tools still trust compromised eMudhra CAs

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

As of October 28, git, curl, and python3 on macOS still trust six compromised eMudhra intermediate CAs that Safari already blocks.

Apple was notified of a compromise of six eMudhra intermediate certificate authorities on October 17, 2026. Since October 19 it has blocked 12 certificates from those CAs, whose private keys were compromised and which could have issued fake TLS certificates for any website. eMudhra and Sectigo have revoked the affected certificates, and Safari, Mail, and apps using Apple's networking framework are protected. As of October 28, git, curl, and python3 shipped with macOS still trust the certificates. macOS 27.2, released October 26, did not fix that gap and reversed hand-applied workarounds. Community authors say an on-path attacker could intercept HTTPS used by those tools, alter git clones and pulls, and capture credentials such as GitHub tokens.

Key facts
  • Apple blocked 12 certificates from six compromised eMudhra intermediate CAs.
  • eMudhra and Sectigo revoked the affected certificates.
  • Safari, Mail, and Apple frameworks are protected automatically.
  • macOS 27.2 left git, curl, and python3 trusting the certificates.
  • Suggested fix: remove affected roots from /etc/ssl/cert.pem and recheck after updates.
  • Further blocks for emSign ECC Root CA - G3 are planned.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 17, 2026Apple notified of the eMudhra certificate compromise. · Hacker News
  2. Oct 19, 2026Apple began blocking 12 certificates from six eMudhra CAs. · Lobsters
  3. Oct 26, 2026macOS 27.2 released without fixing command-line trust. · Hacker News
  4. Oct 28, 2026git, curl, and python3 still trusted the certificates. · Hacker News

What each outlet adds

beyond the shared facts
  • LobstersTwelve blocked certificates, revocations, and planned emSign ECC root block.
  • Hacker NewsOctober 28 CLI gap, macOS 27.2 reversal, and CI review advice.
Vendors
AppleeMudhraSectigo
Products
macOSgitcurlpython3SafariMail

Coverage

oldest first · one row per article · UTC
  1. · 4d ago Lobsters · securityFirst report

    Apple Blocks Compromised eMudhra Intermediate CAs

    Apple is blocking certificates from six compromised eMudhra intermediate CAs that issue TLS certificates, with further updates for command-line tools.

  2. · 2d ago Hacker News · security

    macOS git still trusts compromised eMudhra certificates after 10 days

    macOS 27.2, released October 26, left git, curl, and python3 trusting the certificates and undid manual workarounds.