How do I check whether I am affected by TECH-202610-macos-git-curl-and-python3-still-trust-the-compromised-emudh?

- On each Mac and macOS CI runner, run: git ls-remote https://git-emudhra.we-have-a-problem.com/check.git. A certificate error means you are protected. If it lists a commit, you are affected. - For curl, run curl https://dv-g3b-noct-emudhra.we-have-a-problem.com/ and curl https://dv-g3b-aaa-noct-emudhra.we-have-a-problem.com/. A certificate error means you are protected. - Check whether /etc/ssl/cert.pem still has the eMudhra roots, and check again after every macOS update, because 27.2 restored them.

Live › technique › TECH-202610-macos-git-curl-and-python3-still-trust-the-compromised-emudh

Go to dashboard

high⚡ Early warning · no CVE yetRuntime

macOS git, curl and python3 still trust the compromised eMudhra CAs, and macOS 27.2 undoes the manual fix

Q: What is the fix for TECH-202610-macos-git-curl-and-python3-still-trust-the-compromised-emudh?

- Remove the affected eMudhra roots from /etc/ssl/cert.pem by hand, as the researcher's macOS workaround describes. Run the checks again and repeat the removal after every macOS update until Apple ships a fix. - Bake the removal and the check into macOS CI runner images. - Until fixed, prefer git over SSH on untrusted networks, and rotate any GitHub tokens used over HTTPS from affected Macs on untrusted networks. - Watch for an Apple security update.

Several eMudhra intermediate CA keys were compromised. A researcher's page from 2026-10-28 says Apple was told on 2026-10-17, yet the developer tools Apple ships with macOS (git, curl, python3) still trust the compromised eMudhra certificates. macOS 27.2 came out on 2026-10-26. It does not fix this, and it reverses the workaround users applied by hand (removing the roots from /etc/ssl/cert.pem). Safari and apps that use Apple's networking framework are already protected. Anyone on the network path can intercept HTTPS from these tools. With git, that means clones and pulls over https:// can deliver attacker-chosen code, pushes can be altered, and credentials such as GitHub tokens can be stolen. Developer Macs and macOS CI runners are at risk. The researcher shows a working test interception. No exploitation has been reported. No Apple fix or date is known.

Summary written from the sources below. Check the originals before acting.

Known so far

4/6

high

no CVSS yet; severity from the sources

known so far4 of 6

missing: primary source, exploitation

First public: Oct 28, 2026 UTC
Last modified: Oct 28, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-28 11:15 UTC. All times on this page are UTC.

Who is affected

3 products

Product	Ecosystem	Affected	Fixed in
macOS	vendor	up to and including 27.2 (system git, curl, python3 using /etc/ssl/cert.pem)	–
git	vendor	Apple-shipped git on macOS	–
curl	vendor	Apple-shipped curl on macOS	–

Who cares: ci, early-warning, emudhra, git, macos, technique, tls
Not affected if: –

How to check

On each Mac and macOS CI runner, run: git ls-remote https://git-emudhra.we-have-a-problem.com/check.git. A certificate error means you are protected. If it lists a commit, you are affected.
For curl, run curl https://dv-g3b-noct-emudhra.we-have-a-problem.com/ and curl https://dv-g3b-aaa-noct-emudhra.we-have-a-problem.com/. A certificate error means you are protected.

Know the next one before it finds you.

Add to Slack

macOS git, curl and python3 still trust the compromised eMudhra CAs, and macOS 27.2 undoes the manual fix

Summary written from the sources below. Check the originals before acting.

Product

Ecosystem

Affected

Fixed in

macOS

vendor

up to and including 27.2 (system git, curl, python3 using /etc/ssl/cert.pem)

–

git

vendor

Apple-shipped git on macOS

–

curl

vendor

Apple-shipped curl on macOS

–

macOS git, curl and python3 still trust the compromised eMudhra CAs, and macOS 27.2 undoes the manual fix

Who is affected

How to check

Know the next one before it finds you.

macOS git, curl and python3 still trust the compromised eMudhra CAs, and macOS 27.2 undoes the manual fix

Who is affected

How to check

Know the next one before it finds you.

The fix

Who had it, and when

Sources