Git on macOS still trusts compromised eMudhra certificates
The gist
Apple's built-in git and curl on macOS still accept certificates forgeable with compromised eMudhra keys.
Developers pulling code over https can be intercepted until Apple fixes it.
How it unfolded
- Oct 17, 2026Apple was notified of the eMudhra incident; Firefox and Chrome had blocked the certificates since this date.
- Oct 19, 2026Apple began blocking 12 TLS certificates tied to six affected eMudhra intermediate CAs, and Apple devices blocked them from this date.
- Oct 20, 2026Microsoft platforms blocked the certificates; Chrome, Firefox, Apple and Microsoft had blocked the eight intermediates by this date.