TL;DR
Get business pricing on networking and server gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
A report published Oct. 28 says Apple’s macOS developer tools, including Git, curl and Python 3, continued to trust compromised eMudhra certificates. It says macOS 27.2, released Oct. 26, did not resolve the issue and reversed a manual workaround. Apple’s response and the full scope of affected systems are not established in the supplied material.
A community security report published Oct. 28 says Apple’s developer tools for macOS, including Git, curl and Python 3, still trust compromised eMudhra certificates that could allow attackers to intercept HTTPS connections. The report says Apple was notified on Oct. 17 and that macOS 27.2, released Oct. 26, did not fix the problem and reversed a manual workaround; Apple has not provided a response in the supplied material.
The report, hosted at we-have-a-problem.com and published by Dennis Jackson with community contributors, says the affected certificates remain trusted by developer tools Apple ships with macOS. It describes a risk to HTTPS Git operations, including repository clones and pulls, pushes and credentials sent over connections. These are the report’s findings; the supplied source does not include an independent technical assessment or an Apple statement.
According to the report, a person able to intercept traffic between a developer’s computer and a remote service could present a certificate issued by one of the compromised eMudhra intermediates. If the tools accept that certificate, the connection may be exposed to interception or tampering. The report says the issue also applies to curl, Python 3 and other Apple-shipped tools, while stating that Safari and apps using Apple’s networking framework have already been protected.
The report offers test commands and a manual workaround, and warns that macOS updates may undo the change. It advises developers to repeat checks and reapply the workaround after updates until Apple provides a fix. This article does not reproduce the test commands: the report’s demonstrations use a test server, and its instructions include precautions about credentials and environment.
Risks to Mac-Based Development
If the report’s findings are accurate, developers using affected macOS tools for HTTPS Git activity could face a software supply-chain risk. A tampered clone or pull could introduce unwanted code, while intercepted credentials could expose repository access. The potential reach includes individual developer machines and macOS-based continuous-integration runners used to build or test software.
The report’s warning concerns what the tools trust during HTTPS connections, not a claim that every Git connection has been intercepted. Exploitation would require an attacker to be positioned to interfere with a connection and to use a certificate the client accepts. Even so, certificate validation is a key defense for protecting source code and credentials in transit.
The reported difference between Apple’s framework-based apps and command-line developer tools also matters: protections in one part of macOS do not necessarily mean every application or tool uses the same trust store. Organizations should establish which tools and certificate stores their development systems rely on before judging their exposure.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Anker SOLIX S2000 Portable Power Station, 2,010Wh, 1,500W
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
As an affiliate, we earn on qualifying purchases.
Apple Notification and Update Timeline
The report gives a short timeline: Apple was notified of the eMudhra incident on Oct. 17; macOS 27.2 was released on Oct. 26; and the report was published on Oct. 28, 2026. It says the update left the command-line trust issue unresolved and removed a workaround that users had applied manually.
The report also says that dozens of other projects had shipped fixes days earlier, though the supplied material does not name those projects or specify their remediation methods. Its proposed fix for Apple is to remove affected roots from the certificate file used by the developer tools. The report links to a separate page with manual steps and cautions that system updates can revert changes.
These details come from the community report, rather than release notes or an advisory included in the source material. The article therefore treats the continued trust and update behavior as reported findings, not as independently verified statements from Apple.
“Apple was notified of the eMudhra incident on 17th October.”
— The community report, published by Dennis Jackson and contributors
Verification and Exposure Scope
The supplied source does not include an Apple response, an official security advisory, or an independent confirmation of the report’s tests. It also does not identify the compromised certificates by fingerprint or provide enough information here to determine which macOS versions, configurations or installed certificate stores are affected beyond the tools it names.
It remains unclear whether Apple has since prepared a correction, whether the reported behavior affects every installation of macOS 27.2, and how many users or organizations have applied the manual workaround. The report describes possible interception scenarios, but it does not say that a real-world attack against GitHub or a developer system has occurred.
Apple Fix and Developer Checks
The immediate next step is an Apple clarification or software fix addressing the certificates trusted by macOS developer tools. The report recommends that developers use its checks and manual workaround, then repeat both after each macOS update until an official correction is available. Users should follow the source’s full instructions carefully, particularly its warnings about test commands and credentials.
Security teams can review whether macOS systems are used for source-code access or build infrastructure, identify which tools and trust stores are in use, and determine whether a workaround needs to be maintained. The timing and form of any Apple response are not provided in the source material; the reported status is dated Oct. 28, 2026.
Key Questions
What does the report say is affected?
It says Apple-shipped macOS developer tools, including Git, curl and Python 3, continued to trust compromised eMudhra certificates as of Oct. 28, 2026.
What could happen if a tool trusts one of these certificates?
The report says an attacker able to intercept a connection could potentially tamper with HTTPS traffic or capture information sent over it, including Git credentials. It does not report a confirmed real-world attack.
Did macOS 27.2 fix the issue?
According to the community report, macOS 27.2 did not fix it and reversed a manual workaround. Apple’s own statement is not included in the supplied material.
Has Apple issued a fix?
The source material does not identify an Apple fix for the command-line tools. The report says users may apply a manual workaround and should check again after macOS updates.
Could software build systems be affected?
The report advises security teams to assess macOS machines used in CI or other build infrastructure. Whether a particular system is affected depends on its tools and certificate trust configuration.
Source: emudhra.we-have-a-problem.com
