GoKawiilmacOS developer tools still trust revoked eMudhra certificates after 10 days
Apple was notified on 17 October that eMudhra had issued compromised TLS certificates, but as of 28 October the git, curl and python3 tools bundled with macOS still trust them. The macOS 27.2 update released on 26 October failed to fix the problem and even reverted a manual workaround some users had applied, leaving them exposed again. Many other open-source projects had already shipped fixes days earlier.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaw means anyone able to intercept a Mac user's network traffic could potentially tamper with git clones, pulls and pushes to HTTPS remotes like GitHub, or steal credentials such as access tokens. Apple's slower response compared with volunteer-run open-source projects raises questions about how quickly large vendors patch supply-chain security issues affecting developer tooling bundled with their operating systems. Until Apple ships a proper fix, affected Mac users remain exposed to man-in-the-middle attacks on git operations.
- macOS still ships git, curl and python3 that trust compromised eMudhra certificates as of 28 October, 11 days after notification.
- The macOS 27.2 update undid a manual workaround, leaving previously protected users vulnerable again.
- Users can test exposure with a provided git command; attackers on the network path could intercept credentials or inject malicious code into clones/pulls.
YubiKey 5C NFC Security Key — With certificate trust issues exposing git credentials and HTTPS connections to interception, hardware-backed authentication becomes even more critical. A YubiKey lets you use hardware-based two-factor or passwordless login for GitHub and other git remotes, so even if a token is intercepted, an attacker still can't authenticate as you.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: emudhra.we-have-a-problem.com, 2026-10-28
Published there as: “Ten days later, Git on macOS still trusts the compromised eMudhra certificates”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.