Featured image: Photo by Abdullah Bin Mubarak on Pexels
Apple Addresses Remaining Security Flaw in macOS Updates
Apple has released a series of macOS updates to fully resolve a security vulnerability tied to compromised eMudhra certificates, a fix that had previously been partially implemented in October. The updates, which include versions 27.2.1, 26.7.3, and 15.8.3, now ensure that all affected command-line tools—such as curl and git—cannot accept the fraudulent certificates. This marks the final step in addressing a flaw that had left some system components vulnerable.
The security issue originated from a report by Mozilla, which revealed that private keys for eight intermediate certificate authorities operated by eMudhra, an Indian digital certification company, had been compromised. These certificates are critical for verifying website identities and securing online communications. Attackers with access to the stolen keys could have generated fake certificates, potentially allowing them to impersonate trusted websites and intercept sensitive data.
Apple first responded by automatically blocking the affected certificates in Safari, Mail, and other applications using its networking frameworks. These protections were deployed via automatic certificate configuration updates, requiring no user action. However, the initial measures did not extend to command-line tools, leaving a gap in security that administrators were advised to address manually.
The latest macOS updates eliminate this gap by preventing the compromised certificates from being accepted by command-line utilities. Additionally, the updates remove five root CA certificates from the /etc/ssl/cert.pem file, including three eMudhra certificates not previously covered by Apple’s manual workaround. For users unable to install the latest updates, Apple continues to provide detailed instructions in its support document, listing the 12 affected certificates and five root CA certificates removed by the updates.
Apple also notes that some third-party applications and tools maintain their own lists of root CA certificates and may not rely on its blocklist or the /etc/ssl/cert.pem file. Users encountering such tools are advised to consult the developers for additional steps to secure their systems.
Frequently Asked Questions
What was the initial response by Apple to the eMudhra certificate compromise?
Apple automatically blocked the affected certificates in Safari, Mail, and other apps using its networking frameworks through automatic certificate configuration updates in October.
Why were some command-line tools not covered by the initial fix?
The initial measures did not apply to tools like curl and git, which rely on system-level certificate configurations rather than Apple’s framework-based protections.
What does the latest macOS update include?
The update prevents command-line tools from accepting compromised certificates, removes five root CA certificates from /etc/ssl/cert.pem, and provides manual instructions for users unable to install the update.
The hard truth
While the latest macOS updates resolve the remaining vulnerability, users who cannot install the updates must manually apply fixes. Additionally, third-party apps with custom certificate configurations may still require developer intervention to address the issue fully.
Source Attribution
9to5Mac: https://9to5mac.com/2026/11/09/todays-macos-updates-fix-security-gap-involving-emudhra-certificates/
Source: 9to5Mac