TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report published Oct. 28 says Apple’s macOS developer tools, including Git, curl and Python 3, still trust compromised eMudhra certificates. It says macOS 27.2 did not address the problem and reversed a manually applied workaround; Apple has not provided a response in the supplied material.
A community security report says Apple’s macOS developer tools still trust compromised eMudhra certificates, allowing an attacker positioned on a network path to potentially impersonate HTTPS servers to tools such as Git, curl and Python 3. The report, published Oct. 28, says Apple was notified on Oct. 17 and that macOS 27.2, released two days before publication, did not fix the issue and reversed a manual workaround.
The report, posted on we-have-a-problem.com and published by Dennis Jackson with contributions from the community, says the affected trust remains in developer tools Apple ships with macOS. It contrasts those tools with Safari and other applications built on Apple’s networking framework, which the report says Apple has already protected. The supplied material does not include an Apple statement or independent confirmation of the report’s findings.
According to the report, the risk is that a person able to interfere with a connection could present a certificate issued by one of the compromised eMudhra intermediates and have certain macOS tools accept it. For Git’s HTTPS connections, that could allow an attacker to serve altered repository content during a clone or pull, tamper with a push in transit, or seek to capture credentials sent over the connection. These are described as possible consequences of the certificate trust issue, not evidence that a specific attack has occurred.
The report says it provides test commands to check whether a tool accepts certificates from its test endpoints. It states that a certificate error indicates protection in that test, while a successful response indicates the tool may be affected. The report also warns that a hand-applied workaround can be reverted by macOS updates and advises developers to repeat checks and reapply the workaround until Apple provides a fix.
Risks for macOS Build Pipelines
The concern extends beyond an individual developer’s browsing or source-code checkout. Git and related command-line tools are often used to retrieve dependencies, manage repositories and run automated builds. If a tool accepts an untrusted certificate in a connection an attacker can intercept, the integrity of code fetched or sent over HTTPS could be at risk. That makes the issue relevant to teams that use Mac-based continuous-integration runners or developer workstations to produce software.
The report’s claims do not establish that repositories or credentials have been intercepted. They describe a certificate-validation weakness that could enable interception under the conditions stated. Organizations should treat the report as a security concern to verify against their own systems, while distinguishing that potential exposure from confirmed exploitation. A durable fix from Apple would matter because a manual change may not persist across operating-system updates.
Products Worth Considering
Shark PowerDetect Corded Stick Vacuum, Self-Cleaning (Eggplant, HZ4002)
Ring Alarm 8-Piece Kit (2nd Gen) Home Security System
Philips Hue Secure Wired Video Doorbell, 2K Resolution, Wide Angle View, Integrated Hue Lights, Two-Way Audio, Infrared Night Visibility, Bl
As an affiliate, we earn on qualifying purchases.
Apple’s Notification and Update Timeline
The report says Apple was notified of the eMudhra incident on Oct. 17, 2026. It says that, by Oct. 28, the developer tools it tested continued to trust the affected certificates. The report also says other projects had shipped fixes days earlier, but the supplied source does not name those projects or provide details that would allow that comparison to be assessed independently.
On Oct. 26, Apple released macOS 27.2. According to the report, that update neither resolved the developer-tool trust issue nor preserved users’ manual workaround. It says Apple has already protected Safari and apps using its networking framework, while the command-line tools at issue follow a different certificate-trust path. The report proposes removing affected roots from /etc/ssl/cert.pem as one possible fix, but Apple has not endorsed that approach in the provided source.
“Apple was notified of the eMudhra incident on 17th October.”
— The we-have-a-problem.com report
Testing Scope and Exploitation Status
The supplied material does not identify the exact macOS configurations, tool versions or test methodology used to reach the report’s conclusions. It also does not state whether Apple has acknowledged the notification, whether a patch is being prepared, or whether anyone has exploited the reported weakness. No affected-certificate identifiers or independent test results are included in the source material provided here.
The report describes a network-position requirement: an attacker would need to be able to redirect or intercept relevant traffic. It does not show that ordinary HTTPS connections are automatically compromised or that all users face an active attack. The scope of affected systems, the certificates involved and the current status after the report’s publication remain to be verified.
Apple’s Response and Durable Fix
The next key development is whether Apple confirms the report and issues a correction for macOS’s developer-tool certificate trust store. Until then, the report advises developers to check affected tools and reapply its manual workaround after operating-system updates. Teams using Macs for continuous integration can review whether their runners rely on the tools identified in the report and assess their exposure.
Any verification should follow trusted security guidance and avoid sending real credentials to test servers. The report itself cautions users about credentials in its demonstration instructions. The supplied source gives no date for an Apple fix or further update, so the timeline remains unknown.
Key Questions
What is the reported macOS issue?
The report says Git, curl, Python 3 and other Apple-shipped developer tools still trust compromised eMudhra certificates, potentially allowing an attacker who can intercept traffic to impersonate HTTPS servers to those tools.
Did macOS 27.2 fix the issue?
According to the report, macOS 27.2 did not fix it and reversed a manually applied workaround. Apple’s response is not included in the supplied source.
Does the report show that attacks have occurred?
No. It describes a potential interception risk and a test demonstration, but the supplied material does not report confirmed exploitation or compromised repositories and credentials.
Who may need to review their systems?
Developers using the named macOS tools and organizations running Mac-based CI or build infrastructure may want to check the report’s findings against their systems and follow trusted vendor guidance.
When will Apple release a fix?
The supplied report gives no fix date and includes no Apple statement about a planned update. The timing of a permanent correction is not known.
Source: emudhra.we-have-a-problem.com
