Apple has released critical security updates for macOS versions 27.2.1, 26.7.3, and 15.8.3 that fully insulate the system against a recently discovered vulnerability involving compromised eMudhra intermediate certificate authorities (CAs). Previously, Apple had temporarily blocked the affected certificates in apps like Safari and Mail, but command-line tools remained exposed.
What happened with eMudhra certificates
An Indian digital certification firm, eMudhra, suffered a breach compromising the private keys of eight intermediate CAs. These certificates play a central role in verifying website identities and facilitating secure encrypted connections. With access to the keys, attackers could create bogus certificates that mimic legitimate ones, enabling impersonation or interception of data.
Earlier this October, Apple moved to automatically block these certificates in its major applications. Users did not need to take any action—updates were pushed via certificate configuration updates to cover Safari, Mail, and other apps using Apple’s networking and security frameworks.
The remaining exposure—and Apple’s final fix
Even after those protections, some parts of macOS were still vulnerable. Tools operating via the command line—such as curl and git—were still able to trust the compromised certificates. Apple issued instructions for administrators to work around the issue manually while promising a permanent system-level fix in an upcoming update.
That update has now arrived. The new macOS versions—27.2.1, 26.7.3, and 15.8.3—fully block the compromised eMudhra certificates from all command-line tools. They also strip out five root CA certificates from /etc/ssl/cert.pem, including three additional eMudhra roots that hadn’t been covered under the manual workaround.
For anyone who can’t immediately update, Apple continues to provide a support document listing the 12 intermediate and root certificates affected, along with SHA-256 fingerprints. The document also reminds users that some apps maintain their own certificate store and don’t rely on Apple’s blocks or the system CA file. In those cases, users are advised to contact the developers.
macOS versions supported: • 27.2.1 • 26.7.3 • 15.8.3
Why this matters: Certificate authority compromises are among the riskiest security failures for any operating system. Without updates like these, even savvy users could be vulnerable via obscure tools that don’t use standard certificate blocklists or system CA stores. Apple’s move helps protect all strands of the ecosystem—from GUI apps to dev tools.
