Apple's dev tools still trust compromised eMudhra certs
Original: Apple's git still trusts the compromised eMudhra certificates
Why This Matters
Compromised CA trust in dev tools puts software supply chains at direct risk.
As of Oct 28, Apple's bundled git, curl, and python3 on macOS still trust compromised eMudhra certificates, 11 days after Apple was notified. macOS 27.2 even reverted manual user fixes.
Apple was notified of the eMudhra certificate compromise on October 17. Eleven days later, the developer tools shipped with macOS—git, curl, and python3—still trust the affected certificates. The situation got worse on October 26 when macOS 27.2 shipped without a fix and silently undid workarounds that users had manually applied, leaving them exposed again.
The practical risk is severe. Any HTTPS connection made by these tools can be intercepted. For git, that means clones and pulls from https:// remotes can deliver attacker-chosen code, pushes can be altered in transit, and credentials like GitHub tokens can be stolen. A live proof-of-concept test server is available, impersonating GitHub with a certificate issued by one of the compromised eMudhra intermediates.
Apple has already patched Safari and apps using its native networking framework. The fix for developer tools—removing affected roots from /etc/ssl/cert.pem—is straightforward, yet undelivered. Dozens of other projects, many maintained by volunteers, shipped fixes days ago.
Until Apple acts, developers must remove the affected roots manually and repeat the process after every macOS update. Security teams should also audit whether macOS runners appear in CI or build pipelines, given the supply chain exposure.