TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report published Oct. 28 says Apple’s macOS developer tools, including Git, curl and Python 3, still trust compromised eMudhra certificates. The report says macOS 27.2 also reverted a manual workaround; Apple had been notified on Oct. 17. The scope and Apple’s planned response remain unclear.
A report published Oct. 28 says Apple’s developer tools for macOS, including Git, curl and Python 3, still trust compromised eMudhra certificates, potentially allowing attackers positioned along a network connection to intercept or alter HTTPS traffic. The report says Apple was notified on Oct. 17, and that macOS 27.2, released Oct. 26, did not address the issue and reversed a manual workaround some users had applied.
The report, hosted at we-have-a-problem.com and published by Dennis Jackson, says the affected tools rely on certificate trust settings that continue to accept certificates tied to the eMudhra incident. It identifies Git’s HTTPS operations as a risk: if a connection is intercepted, an attacker could potentially tamper with repository data during clones or pulls, alter pushes, or capture credentials sent over the connection. These are the report’s technical assessment; the supplied material does not document a real-world attack exploiting the issue.
The site provides test commands for Git and curl that connect to demonstration servers using certificates associated with the incident. It says a certificate error indicates the tested tool rejects the certificate, while a successful response suggests that the tool accepts it. The Git demonstration uses a command-specific address override and a test repository; the report warns readers to retain the fake-user@ prefix in its example to avoid sending GitHub credentials to the test server.
According to the report, Apple has already protected Safari and other applications built on its networking framework, but the developer tools it names remain affected. It recommends that Apple remove the affected roots from /etc/ssl/cert.pem or otherwise ship a fix. The report also says developers who applied its manual workaround may need to repeat the checks and workaround after macOS updates, because updates can revert local changes.
Risks for Git and Build Pipelines
The concern extends beyond browsing: developers and automated build systems use Git, curl and Python to retrieve source code, packages and other resources over HTTPS. If a tool accepts a certificate that should no longer be trusted, a network attacker with the ability to intercept traffic could potentially present a fraudulent server identity. That could put source code, build inputs and credentials at risk, depending on the affected connection and the defenses in place.
The report specifically flags macOS machines used as continuous-integration runners, where automated processes may fetch code or dependencies without a person checking each connection. It advises security teams to identify whether such systems are in use and assess supply-chain exposure. The report does not establish that any particular developer, organization or build pipeline has been attacked, nor does it quantify how many systems are affected.
The issue also highlights a difference between Apple’s app networking framework and certificate handling in bundled command-line tools, as described by the report. A browser or application being protected does not, by itself, show that Git or other developer utilities have received the same trust-store change.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Apple Notification and Update Timeline
The report says Apple was notified about the eMudhra incident on Oct. 17, 2026. It then identifies macOS 27.2, released Oct. 26, as an update that did not fix the developer-tool trust issue and that reversed a manual workaround users had made. The report was published two days later, on Oct. 28.
Its authors say dozens of other projects had shipped fixes days earlier, including projects maintained by volunteers. The supplied source does not name those projects or provide details about their fixes, so that comparison cannot be independently assessed from the material provided. The site describes itself as a community effort, points to a public GitHub source repository and says contributions are welcome.
The report’s recommended manual action is to remove affected roots from the relevant certificate bundle, and it directs readers to a separate page for step-by-step macOS instructions. Because its claim is that an operating-system update may restore the affected certificates or undo local changes, the site advises checking the tools again after updates. That is guidance from the report, not a statement of Apple’s official remediation process.
“Apple was notified of the eMudhra incident on 17th October.”
— The eMudhra incident report
Scope and Apple Response Remain Unknown
The supplied source is a community report, not an Apple advisory or an independent technical audit. It does not include a response from Apple, confirmation of the notification, or a timeline for a fix. The report’s test commands and claims are available for review, but the source material does not provide independent validation of their results across macOS versions and configurations.
It is also unclear which macOS releases and certificate-bundle configurations are affected, how many systems retain the certificates, and whether the manual workaround was reversed in every case. The report describes possible interception and tampering scenarios, but does not identify confirmed victims, attacks in the wild, or evidence that credentials have been stolen through this issue.
Watch for a Developer-Tools Fix
The next key development would be an Apple update or advisory addressing certificate trust in Git, curl, Python 3 and other bundled command-line tools. The report urges developers to test their own systems and repeat checks after macOS updates if they have applied its manual workaround. Security teams can review whether macOS machines are used for automated builds and consider the report’s stated supply-chain risks while the issue remains unresolved.
No Apple release date or formal remediation plan appears in the supplied material. Until Apple clarifies the scope and publishes a fix, users should distinguish the report’s warning and suggested workaround from confirmed guidance issued by the company.
Key Questions
What is the reported problem?
The report says macOS developer tools, including Git, curl and Python 3, still trust compromised eMudhra certificates as of Oct. 28, 2026. It says that could permit HTTPS interception under the right network conditions.
Did macOS 27.2 fix the issue?
No, according to the report. It says macOS 27.2, released Oct. 26, did not fix the developer-tools issue and reversed a manual workaround some users had applied.
Has Apple confirmed the report or announced a fix?
The supplied source contains no Apple statement confirming the findings and gives no fix timeline. It says Apple was notified on Oct. 17, but that notification is reported by the site’s authors.
Are there confirmed attacks or victims?
The report describes ways the trust issue could enable interception or tampering, but the supplied material does not identify confirmed attacks, victims or stolen credentials.
What should developers and security teams do now?
The report recommends checking affected tools, reviewing its manual workaround and repeating checks after macOS updates. It also advises security teams to assess whether macOS build runners could be exposed. These are recommendations from the report, not Apple-issued instructions.
Source: emudhra.we-have-a-problem.com
