GoKawiilApple patches macOS command-line tools against compromised eMudhra certificates
Apple released macOS 27.2.1, 26.7.3 and 15.8.3 to stop command-line tools like curl and git from accepting eight compromised eMudhra certificate authority keys. Apple had already blocked the certificates in Safari, Mail and other apps via automatic configuration updates starting October 19, but command-line tools remained exposed until today's patch. The updates also strip five root CA certificates, including additional eMudhra certificates, from the system's trust store.
GoKawiil's interpretation of the reporting above, not reported fact.
The compromised private keys could have let attackers forge certificates to impersonate websites and intercept encrypted traffic, so closing this remaining gap removes a path that previously required manual administrator intervention. The staggered rollout - first blocking in consumer apps, then patching system tools weeks later - highlights how certificate authority compromises can leave gaps across an operating system's many components.
- Apple shipped macOS 27.2.1, 26.7.3 and 15.8.3 to fix a gap left by compromised eMudhra certificates
- Command-line tools such as curl and git were previously still able to accept the fraudulent certificates
- The updates remove five root CA certificates from the system trust store, including extra eMudhra ones
Source: 9to5mac.com — Marcus Mendes, 2026-11-09
Published there as: “Today’s macOS updates fix security gap involving eMudhra certificates”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.