28th October 2026
Apple was notified of the eMudhra event on 17th October. As of 28th October, the developer tools Apple ships alongside macOS, including git, curl and python3, motionless rely the compromised certificates.
Worse, macOS 27.2, released on 26th October, did not fix the matter and undid the workaround that users had applied by hand, leaving them susceptible again.
Meanwhile, dozens of another projects, many run by volunteers, shipped fixes days ago.
Why does this matter?
Anyone can obstruct any HTTPS association these tools make.
For git, that method clones and pulls from https:// remotes can provision attacker-chosen code, pushes can be altered in transit, and your credentials, specified as GitHub tokens, can be intercepted.
To inspect whether your git is affected, run:
git ls-remote https://git-emudhra.we-have-a-problem.com/check.git
A certificate error method your git is protected. If git lists a commit, your git is affected. Your connections to GitHub, or any another https:// git remote, can be intercepted and tampered with.
To see an assault end to end, run the command below in a impermanent directory. It clones a repository from a test server impersonating GitHub. The -c choice redirects github.com to our test server for this one command only. The server presents a github.com certificate issued by among the compromised eMudhra intermediates.
git -c http.curloptResolve=github.com:443:15.235.19.186 copy https://[email protected]/galadran/emudhra-git-test
A patched git volition refuse alongside a certificate error. If the copy succeeds, you'll see a README.md starting alongside INTERCEPTED.
A genuine attacker would not need the additional option. Anyone on the network way between you and GitHub can redirect your traffic themselves.
You can substitute the demo repository alongside any other, community or private. Keep the fake-user@ prefix. Without it, git would dispatch your GitHub credentials to the test server. For example:
git -c http.curloptResolve=github.com:443:15.235.19.186 copy https://[email protected]/Homebrew/brew
curl, python3 and the another tools Apple ships are affected in the identical way. To inspect curl, run:
curl https://dv-g3b-noct-emudhra.we-have-a-problem.com/ curl https://dv-g3b-aaa-noct-emudhra.we-have-a-problem.com/
A certificate error method curl is protected.
What should Apple do?
Apple has already protected Safari and another apps built on its networking framework.
Apple needs to container a fix for macOS developers as shortly as possible, for example by removing the affected roots from /etc/ssl/cert.pem.
What can developers do in the meantime?
The affected roots can be removed by hand. The macOS workaround on the chief leaf walks through the steps. Apple's guidance states that macOS updates may revert the fix, so developers need to reiterate the checks complete and the workaround following all update until Apple ships a fix.
Security teams should additionally regard whether macOS runners are used in their CI or another build infrastructure and measure the provision sequence risk.
Site published by Dennis Jackson. This location is the activity of many contributors from the community. The origin is on GitHub and PRs are welcome. Licensed under the Apache License, Version 2.0.
