Apple told developers to patch certificates by hand, then macOS 27.2 reverted the patch
Nine days after Apple was notified about the compromised eMudhra CAs, macOS 27.2 shipped and quietly undid the workaround users had applied.
git, curl and python3 on macOS still trust the compromised eMudhra intermediates, a researcher's test page shows, while Safari and apps on Apple's networking stack are protected. Anyone able to sit on the network path could alter a clone or lift a GitHub token.
Apple's own advice is to re-check after every update.
Which Apple tools still trust the bad certificates
The test page says Apple's command-line tools, git, curl and python3 among them, still accept the compromised eMudhra certificates, even though dozens of other projects shipped fixes days ago. Safari and other apps built on Apple's networking framework are already protected.
The timeline it lays out: Apple was notified on 17 October; macOS 27.2 came out on 26 October without a fix and reverted the manual workaround; the page went up on 28 October. The risk is the usual one for a trusted-but-wrong root: someone who can intercept the connection can read or modify HTTPS traffic, so clones and pulls can carry attacker-chosen code and tokens can leak. The page offers a git ls-remote check against a test repository, where a certificate error means you are protected.
Apple's support note on the compromised intermediate CAs states that macOS updates may revert the fix, which is why the page tells developers to repeat the check after every update.
The thread: the title blames git, the problem is the system store
The most upvoted pushback was about framing:
"It should be "Apple still ships compromised CA in /etc/". Git is just a victim like every other app using system CA" — a commenter objecting to the title
On the remedy, a developer who uses Homebrew's own git and curl called Apple's advice "outrageous":
"Kind of outrageous that Apple's guidance is to edit the cert chain manually, and to expect that subsequent OS updates may revert your mitigation, reintroducing the vulnerability (as happened at least once so far)." — a developer who uses Homebrew's git and curl
The Idris maintainer saw it as a delivery problem rather than a security one:
"Apple should copy Windows Update, I have no idea how they have got this far without a method to add small patches outside monolithic OS updates." — kryptiskt, an Idris maintainer
What to do before Apple ships a fix
Check the CI runners first: they run the same system tools, are rarely touched by hand, and are exactly where a stolen token would hurt most. A fix that lives in /etc/ssl can be undone by the next point release, so put the check in the pipeline rather than relying on someone remembering it.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
A fingerprinting script is full of poison text, aimed at the AI you ask to read it
The author fed an obfuscated anti-bot script to an AI model and got a refusal citing biological-weapons risk. The script had been written to cause exactly that.