The macOS Golden Gate 27.2.1 update Apple released today addresses the eMudhra certificate vulnerability, and Apple recommends users update to the latest software.
For Macs that run macOS 26 or macOS 15, Apple has released macOS 26.7.3 and macOS 15.8.3.
Apple previously blocked the compromised certificates in Safari, Mail, and apps that use Apple frameworks in October to protect most users, but command-line tools like curl and git were still able to accept them. With macOS 27.2.1, command-line tools will no longer accept the certificates.
Prior to releasing the macOS 27.2.1 update, Apple offered instructions for those who wanted to protect themselves from the compromised eMudhra certificates when using command-line tools, directing users to manually remove the affected root certificates from their Mac's "/etc/ssl/cert.pem" file.
Apple still has those instructions available for users who are unable to update their Macs.
The compromised security certificates were issued by certificate authority eMudhra. An investigation launched by Mozilla found the certificates used private key values below 256, making them trivial to recover. Attackers could use the keys to create fraudulent certificates that appeared valid for any website.
Apple also fixed the issue in the macOS Golden Gate 27.3 beta, but with the fix also included in macOS 27.2.1, users won't need to wait until December for protection.
