---
id: "TECH-202610-macos-git-curl-and-python3-still-trust-the-compromised-emudh"
kind: "technique"
aliases: []
title: "macOS git, curl and python3 still trust the compromised eMudhra CAs, and macOS 27.2 undoes the manual fix"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "macOS", "fixed": [], "affected": "up to and including 27.2 (system git, curl, python3 using /etc/ssl/cert.pem)", "ecosystem": "vendor"}, {"name": "git", "fixed": [], "affected": "Apple-shipped git on macOS", "ecosystem": "vendor"}, {"name": "curl", "fixed": [], "affected": "Apple-shipped curl on macOS", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ci", "early-warning", "emudhra", "git", "macos", "technique", "tls"]
not_affected_if: []
published_at: "2026-10-28T00:00:00+00:00"
first_seen_at: "2026-10-28T11:15:01+00:00"
updated_at: "2026-10-28T11:15:01+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-28T11:15:01+00:00"}]
---

# macOS git, curl and python3 still trust the compromised eMudhra CAs, and macOS 27.2 undoes the manual fix

Several eMudhra intermediate CA keys were compromised. A researcher's page from 2026-10-28 says Apple was told on 2026-10-17, yet the developer tools Apple ships with macOS (git, curl, python3) still trust the compromised eMudhra certificates. macOS 27.2 came out on 2026-10-26. It does not fix this, and it reverses the workaround users applied by hand (removing the roots from /etc/ssl/cert.pem). Safari and apps that use Apple's networking framework are already protected. Anyone on the network path can intercept HTTPS from these tools. With git, that means clones and pulls over https:// can deliver attacker-chosen code, pushes can be altered, and credentials such as GitHub tokens can be stolen. Developer Macs and macOS CI runners are at risk. The researcher shows a working test interception. No exploitation has been reported. No Apple fix or date is known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:macOS affected up to and including 27.2 (system git, curl, python3 using /etc/ssl/cert.pem) fixed ?
- vendor:git affected Apple-shipped git on macOS fixed ?
- vendor:curl affected Apple-shipped curl on macOS fixed ?

## How to check

- On each Mac and macOS CI runner, run: git ls-remote https://git-emudhra.we-have-a-problem.com/check.git. A certificate error means you are protected. If it lists a commit, you are affected.
- For curl, run curl https://dv-g3b-noct-emudhra.we-have-a-problem.com/ and curl https://dv-g3b-aaa-noct-emudhra.we-have-a-problem.com/. A certificate error means you are protected.
- Check whether /etc/ssl/cert.pem still has the eMudhra roots, and check again after every macOS update, because 27.2 restored them.

## Fix

- Remove the affected eMudhra roots from /etc/ssl/cert.pem by hand, as the researcher's macOS workaround describes. Run the checks again and repeat the removal after every macOS update until Apple ships a fix.
- Bake the removal and the check into macOS CI runner images.
- Until fixed, prefer git over SSH on untrusted networks, and rotate any GitHub tokens used over HTTPS from affected Macs on untrusted networks.
- Watch for an Apple security update.

## Timeline

- 2026-10-28T11:15:01+00:00 analyst

## Documents

- [describes] Ten days later, Git on macOS still trusts the compromised eMudhra certificates https://news.ycombinator.com/item?id=50271640
- [describes] Apple's git still trusts the compromised eMudhra certificates https://emudhra.we-have-a-problem.com/apple.html

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_