Ten days later, Git on macOS still trusts the compromised eMudhra certificates

Apple was alerted on 17 October about a compromise of eMudhra intermediate certificates. By 28 October, the developer tools shipped with macOS—including Git, curl and Python 3—still trusted those certificates, and the macOS 27.2 update released on 26 October did not address the problem, even undoing a manual workaround applied by users.

The continued trust of the compromised roots means any HTTPS connection made by these tools can be intercepted, allowing attackers to modify Git clones, pushes, and capture credentials such as GitHub tokens. Similar vulnerabilities affect curl and Python 3, while Safari and other apps built on Apple’s networking framework have already been protected. Removing the affected roots from /etc/ssl/cert.pem or delivering an official fix is recommended.