TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report published on Oct. 28 says Apple’s macOS developer tools, including Git, curl and Python 3, still trust compromised eMudhra certificates. It says macOS 27.2, released Oct. 26, did not correct the issue and reversed a manual workaround; Apple has not provided a response in the supplied source material.
A report published Oct. 28 says Apple’s macOS developer tools, including Git, curl and Python 3, still trust compromised certificates issued by eMudhra, potentially allowing attackers positioned on a network path to impersonate HTTPS servers. The report says Apple was notified on Oct. 17 and that macOS 27.2, released two days before publication, did not fix the problem and reversed a manual workaround. These findings come from the report’s authors; Apple’s response is not included in the available material.
The report, hosted at we-have-a-problem.com and attributed to Dennis Jackson and community contributors, says the affected trust remains in the developer tools Apple ships with macOS. The authors say Apple had already protected Safari and other apps that use its networking framework, but that this did not extend to the command-line tools covered by their tests. The report does not include an Apple statement confirming the scope or status of the issue.
According to the authors, a person able to intercept traffic between a Mac and an HTTPS service could exploit the trust in the compromised certificates to impersonate that service. For Git connections using HTTPS, the report warns that such an interception could affect repository clones and pulls, alter data in transit, or expose credentials such as GitHub tokens. These are described as potential outcomes of a successful network interception, not as evidence that an attack has occurred.
The report provides test commands and says a certificate error indicates the tested Git or curl connection rejected the certificate; a successful test connection indicates the tool accepted it. It says the demonstration uses a test server and a command-specific hostname redirection, and warns users to keep a fake username in the example URL to avoid sending credentials. Its authors say affected roots can be removed manually, but Apple updates may undo that change, requiring users to check and repeat the workaround after updates.
Risk to HTTPS-Based Development
If the report’s findings are accurate, the issue reaches beyond ordinary browsing: Git, curl and Python are commonly used in software development and automated build systems. Trusting a compromised certificate could undermine the identity checks that HTTPS relies on, allowing a network intermediary to present a false server identity to an affected tool.
For developers, the potential exposure includes source code, credentials and build inputs moved through HTTPS connections. A manipulated repository or intercepted token could create risks for a project and for downstream users, though the source material does not document a confirmed attack or stolen credential. Security teams may also need to determine whether affected Macs are used as continuous-integration runners or in other build infrastructure, as the report advises.
The report says dozens of other projects had already shipped fixes, but does not name them or provide a comparison of their responses. The central question for Mac users is whether Apple’s certificate trust configuration for developer tools has been updated and whether any manual changes will persist across system updates.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
EcoFlow Smart Home Panel 2 Whole-Home Backup System Hub
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
As an affiliate, we earn on qualifying purchases.
Apple Notification and Update Timeline
The report dates Apple’s notification to Oct. 17, 2026, and its own publication to Oct. 28. It identifies macOS 27.2, released Oct. 26, as a subsequent update that did not resolve the developer-tool trust issue and reversed a workaround some users had applied manually. The supplied source does not show the notification itself or provide Apple’s confirmation of either date or the update’s effect.
The authors distinguish the command-line tools from Safari and other apps using Apple’s networking framework, which they say Apple had protected. They recommend removing affected certificate roots from /etc/ssl/cert.pem as a temporary measure and point readers to a separate guide. Their warning that system updates may revert manual changes means users should not assume a workaround remains in place after updating.
“Apple was notified of the eMudhra incident on 17th October.”
— The we-have-a-problem.com report
Apple Response and Exposure Scope
The supplied material contains no response from Apple and does not establish whether the company has since released a correction. It also does not provide Apple documentation confirming that macOS 27.2 reverses the workaround, nor independent testing details sufficient to verify every version or configuration of Git, curl and Python 3.
The report describes a possible interception scenario, but does not identify a real-world victim, a confirmed exploitation campaign, or evidence that credentials or repositories have been compromised. The number of affected Macs and the precise set of eMudhra certificates and tool versions involved are not specified. The authors’ test commands are presented as checks of particular connections; the source does not establish that passing or failing one test alone determines every user’s risk.
Patch Status and Developer Checks
The next key development is whether Apple issues a macOS fix that removes the affected certificate trust for developer tools and whether it remains effective after updates. Until then, the report advises developers to use its separate manual-removal instructions, then recheck after every macOS update because the workaround may be reversed.
Organizations should review whether Macs are used for CI jobs or other build tasks and assess whether those systems rely on the affected HTTPS tools. The report does not give a date for an Apple patch or say that one is planned. Readers should look for an official Apple advisory and updated guidance from the affected tool maintainers before treating the issue as resolved.
Key Questions
What does the report say is affected?
It says Apple’s macOS developer tools, including Git, curl and Python 3, still trust compromised eMudhra certificates as of Oct. 28, 2026. Apple’s own confirmation is not included in the source material.
What could an attacker do if the report is accurate?
An attacker able to intercept a connection could potentially impersonate an HTTPS server to an affected tool. For Git, the report says this could put clones, pulls and credentials at risk. It does not report a confirmed attack or stolen data.
Did macOS 27.2 fix the issue?
The report says macOS 27.2, released Oct. 26, did not fix the problem and reversed a manual workaround. The supplied material does not include Apple’s response or independent confirmation of that claim.
What should developers do while they wait for a fix?
The report recommends removing affected roots from the certificate bundle using its manual instructions, then checking again after each macOS update. It warns that updates may undo the change and advises security teams to review Mac-based CI and build systems.
Source: emudhra.we-have-a-problem.com
