Apple today released macOS updates that address a security gap involving compromised eMudhra certificates, following initial blocks in Safari, Mail, and other apps in October. A few weeks ago, Mozilla reported that private keys of eight intermediate certificate authorities operated by eMudhra, an Indian digital certification company, had been compromised. These certificates are used to establish trust in digital identities and enable secure connections. With access to the compromised private keys, bad actors could create fraudulent certificates to impersonate websites and intercept user information.
In response, Apple began automatically blocking the affected certificates on October 19, with additional protections on October 23. These changes were delivered through automatic certificate configuration updates, meaning users did not need to install an update to be protected. While these measures protected Safari, Mail, and apps using Apple's networking frameworks, they did not cover all of macOS. Certain command-line tools, including curl and git, could still accept the compromised certificates.
Today, Apple updated the document to confirm that the fix is now available. macOS 27.2.1, macOS 26.7.3, and macOS 15.8.3, released earlier today, prevent the affected command-line tools from accepting the compromised certificates, eliminating the need for administrators to manually address the issue. The updates also remove five root CA certificates from /etc/ssl/cert.pem, including three additional eMudhra certificates. For users unable to install the latest updates, Apple continues to provide manual instructions in its support document, along with SHA-256 fingerprints of the 12 affected certificates and five root CA certificates removed.
Source: 9to5Mac · Summarized by HeadlinesBriefing