TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report published Oct. 28 says Git and other developer tools shipped with macOS still accept compromised eMudhra certificates, ten days after Apple was notified. The report says macOS 27.2, released Oct. 26, did not fix the issue and reversed a manual workaround; Apple has not provided a response in the supplied material.
A community-maintained report says Git and other developer tools included with macOS still trust compromised eMudhra certificates as of Oct. 28, ten days after Apple was notified of the incident. The report says macOS 27.2, released Oct. 26, did not resolve the trust issue and reversed a workaround some users had applied manually, potentially restoring exposure on updated systems.
The report, published on we-have-a-problem.com by Dennis Jackson and other contributors, says Apple’s shipped versions of Git, curl and Python 3 continue to trust the affected certificates. It says the issue allows a party able to intercept a network connection to present a certificate that these tools accept, potentially enabling interception or alteration of HTTPS traffic. The site’s account is the source for the reported status; the supplied material does not include a statement from Apple confirming its findings.
For Git users, the report identifies possible effects on HTTPS remotes: an intercepted clone or pull could deliver code selected by an attacker, a push could be altered in transit, and credentials such as GitHub tokens could be exposed. Those are described as potential consequences of successful interception, not as evidence that any such attack has occurred. The report says the risk could apply to connections to GitHub or other HTTPS Git remotes.
The site’s authors say users can check whether their Git installation accepts the affected certificate by running a test against a site they operate. A certificate error indicates the tested client rejected the certificate; a listed commit indicates it accepted it, according to the report. They also provide a curl test. These checks are the site’s proposed diagnostics, not an independent audit of every macOS installation. The report advises developers who used its manual workaround to check again after system updates.
Risks to HTTPS-Based Development
If the report’s findings are accurate, the issue could affect the integrity and confidentiality of developer workflows, not just ordinary web browsing. Git clients are commonly used to retrieve source code and publish changes. A network intermediary able to exploit the certificate trust problem could potentially interfere with those exchanges, creating a route to tampered code or exposed credentials.
The potential reach also extends to automated build and continuous-integration systems that use macOS runners. Compromised source or credentials could have consequences beyond one developer’s machine, depending on the affected environment and what access its tokens or build processes hold. The report urges security teams to review whether macOS systems are part of their build infrastructure. It does not establish that any organization has been attacked or that a specific project has been compromised.
The reported reversal of a manual fix matters because a user who previously mitigated the problem may assume the protection remains after an operating-system update. If the update resets the relevant certificate configuration, that assumption could leave developer tools trusting certificates again. The report recommends repeating checks and the workaround after updates until Apple issues a fix.
Products Worth Considering
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, and Liquid Retina Display
Apple MacBook Pro 16.2-inch with M5 Pro, 18-core CPU, 20-core GPU, 48GB Memory, 1TB SSD, Wi-Fi 7, Space Black
Apple MacBook Pro 2021 16‑inch with M1 Max, 32 GB RAM, 2 TB SSD, Space Gray (QWERTY English)
As an affiliate, we earn on qualifying purchases.
Apple Notification and Update Timeline
According to the report, Apple was notified of the eMudhra incident on Oct. 17, 2026. The page was dated Oct. 28 and characterized the continuing trust by macOS developer tools as unresolved. It says macOS 27.2 arrived on Oct. 26 without fixing the issue and undid a manual workaround used by some users.
The report contrasts this with other projects that it says had shipped fixes in the intervening days, but the supplied source does not name those projects or provide a count beyond saying dozens. It also says Apple had already protected Safari and other applications built on its networking framework. The concern described here is specifically about developer tools that use a different certificate trust setup, rather than a claim that every Apple app is affected.
The proposed remedy for Apple is to remove the affected roots from /etc/ssl/cert.pem, according to the report. Its contributors say users can remove them manually in the meantime, while warning that macOS updates may undo that change. The source links to a separate page with instructions, but those operational steps are not reproduced here.
“Apple was notified of the eMudhra incident on 17th October.”
— The we-have-a-problem.com report
Scope and Apple Response Remain Unclear
The supplied material does not include an Apple statement, a technical advisory from Apple, or independent verification of the report’s tests. It is not clear whether Apple has acknowledged the specific macOS developer-tool issue publicly, whether a fix is in development, or when one might ship. The report says Apple was notified, but does not provide the notification itself or a response.
The source does not specify which macOS releases or configurations remain affected, how many users or build systems have the certificates, or whether any real-world interception has taken place. Its test results describe the behavior of clients when pointed at test hosts; they do not establish that traffic to GitHub or another service has actually been intercepted. The report’s warning about potential credential exposure should be read as a risk scenario, not a confirmed breach.
It is also unclear from the supplied source which manual fixes were reversed by macOS 27.2 and whether all users who applied them experienced the same behavior. The report recommends rechecking individual systems, underscoring that status may depend on a device’s configuration and update history.
Developers Should Recheck After Updates
The report’s immediate advice is for developers to test their macOS Git and curl clients and, if affected, apply the manual certificate-removal workaround described on its main page. It warns that an operating-system update may undo that change, so users should repeat the checks and mitigation after each update until a vendor fix is available. Users should consult the report’s instructions directly rather than assume a prior workaround remains in place.
Security teams are advised to identify macOS machines used in CI, build, and other development infrastructure, then assess what source repositories and credentials those systems can access. The material does not prescribe a broader response or report that a particular organization has taken action.
The next major development would be an Apple-issued fix or public guidance addressing the certificates trusted by these tools. Until that appears, the report’s claims remain a community-reported status that should be verified against individual systems. The timing and form of any Apple response are not established by the source.
Key Questions
What is the reported macOS issue?
The report says Git, curl and Python 3 shipped with macOS still trust compromised eMudhra certificates as of Oct. 28, 2026. It says this could allow an attacker positioned to intercept a connection to interfere with HTTPS traffic accepted by those tools.
Did macOS 27.2 fix the problem?
According to the Oct. 28 report, macOS 27.2 did not fix the trust issue and reversed a manual workaround some users had applied. The supplied material does not include Apple’s account of the update or independent confirmation of the report’s finding.
Have attacks or stolen credentials been confirmed?
No real-world attack or credential theft is confirmed in the supplied source. The report describes potential outcomes if traffic is intercepted, including altered Git transfers and exposed credentials; it does not say those events have occurred.
What should macOS developers do now?
The report advises users to run its checks, follow the manual workaround if affected, and repeat the checks after macOS updates because updates may revert the change. Security teams should also review whether macOS systems are used for CI or other build work.
Source: emudhra.we-have-a-problem.com
