3 stories
git, curl and python3 on macOS still trust the compromised eMudhra intermediates, a researcher's test page shows, while Safari and apps on Apple's networking stack are protected. Anyone able to sit on the network path could alter a clone or lift a GitHub token.
Apple's own advice is to re-check after every update.
The top HN threads: facts from the discussions, both sides, insider voices. Email, Telegram, or RSS.
eMudhra will withdraw from issuing public TLS certificates, keeping revocation services running until every issued certificate has expired or been replaced. Customers get replacements free through partners.
In the thread, a commenter reports that an up-to-date iPhone was still trusting the compromised CAs nearly five days after the report.
Eight eMudhra intermediate CA certificates, valid since April 2025, had keys that could be computed from the certificates themselves. A commenter pulled out the scalars: 4, 56, 66, 115, 155, 156, 230, 237.
Firefox shipped a fix in hours via OneCRL; a Mozilla engineer in the thread says everything outside the big browsers is still exposed.