Apple has blocked eight compromised intermediate web security certificates that could have been used by scammers to impersonate legitimate sites. A script error created private keys that can be discovered by testing only 256 possible numbers.
Although the certificates are now revoked, macOS presents a persistent risk. Its built-in /usr/bin/curl utility includes a certificate bundle that does not check revocation information, meaning that any Mac that previously accepted one of these certificates will continue to trust it.
Bleeping Computer confirms that Apple, Google, and Mozilla have each blocked the certificates in their respective browsers. However, until Apple releases an update fixing the revocation-checking gap, users may experience continued trust in these vulnerable certificates.
Source: 9to5Mac · Summarized by HeadlinesBriefing