eMudhra: macOS developer tools still trust revoked certificates
eMudhra says git, curl and python3 in macOS still accept its compromised certificates, and macOS 13.2 undoes users' manual fix.
eMudhra reported on October 28, 2026 that developer tools bundled with macOS, including git, curl and python3, still trust the compromised eMudhra certificates, according to gigazine.net. The company said Apple was notified of the incident on October 17, 2026.
Apple has already fixed Safari and other apps built on its network frameworks, but no patch has been released for the developer tools. macOS 13.2, released on October 26, 2026, does not address the issue and reverts a manual workaround that users had applied.
eMudhra recommends that developers manually remove the compromised root certificate file until Apple issues a patch.
Testing the flaw
Running git ls-remote against the test URL git-emudhra.we-have-a-problem.com/check.git returns a certificate error if git is fixed and succeeds if it is not. Cloning from a fake GitHub server at 15.235.19.186 shows the attack in action: an unpatched git completes the clone and opens a README.md file beginning with INTERCEPTED.
On October 20, 2026, it emerged that the private keys of eight eMudhra intermediate CA certificates had been compromised. Google and Mozilla moved to revoke the affected certificates, and on October 22, 2026 eMudhra said it would withdraw from the SSL/TLS certificate business.
Quick answers
Which macOS tools are affected?
eMudhra says the bundled developer tools, including git, curl and python3, still trust the compromised certificates. Safari and other apps based on Apple's network frameworks have already been fixed.
Does macOS 13.2 fix the problem?
No. According to eMudhra, macOS 13.2, released on October 26, 2026, does not address the issue and reverts a manual workaround users had applied.
What can developers do until Apple patches it?
eMudhra recommends manually removing the compromised root certificate file as a workaround until Apple issues a patch.