# Apple Patches macOS Security Gap Linked to eMudhra Certificates New macOS updates resolve vulnerabilities in command-line tools caused by compromised digital certificates. - **Source:** [9to5Mac](https://brifing.si/source/59447403-ce5b-427c-8132-8614f549929a) - **Published:** 2026-11-09 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/4521301f-c46c-4974-8eae-79f1c61f17fd ## Security Gap Addressed Apple has released macOS updates to resolve a security vulnerability involving compromised eMudhra digital certificates. These certificates, which verify website identities, were previously identified as compromised by Mozilla. The breach of eight intermediate certificate authorities posed risks, as attackers could potentially impersonate legitimate websites to intercept sensitive user information from unsuspecting individuals. ## Initial Mitigation Efforts In October, Apple implemented automatic blocks for the affected certificates within Safari, Mail, and various system applications. These initial protections were delivered via automatic configuration updates, bypassing the need for a full system install. However, these measures were incomplete, leaving specific command-line tools like curl and git vulnerable to the compromised certificates. ## New System Updates The latest macOS versions, specifically 27.2.1, 26.7.3, and 15.8.3, now fully address the remaining security gaps. These updates prevent command-line tools from accepting the compromised certificates, effectively automating the protection process. This eliminates the requirement for system administrators to manually configure security settings to mitigate risks associated with the Indian digital certification company. ## Root Certificate Removal Beyond patching the command-line tools, the updates remove five root CA certificates from the system file /etc/ssl/cert.pem. This action includes three additional eMudhra certificates that were not covered by Apple's original manual workaround. By purging these specific files, Apple ensures that the compromised authorities no longer hold trusted status within the operating system. ## Manual Workaround Availability For users unable to install the latest macOS updates, Apple maintains a support document with manual instructions. This guide provides the names and SHA-256 fingerprints of the 12 affected certificates and the five root CA certificates removed. Users can reference this documentation to verify their system status if they cannot perform the update. ## Third-Party App Limitations Apple warns that some applications and tools maintain their own independent lists of root CA certificates. These programs do not rely on Apple’s blocklist or the /etc/ssl/cert.pem file for security verification. Consequently, users are advised to contact individual developers directly to ensure their specific software tools have been updated to mitigate these risks. ## Context of Compromise The issue originated when Mozilla reported that private keys belonging to eMudhra were compromised. These keys are essential for establishing trust in digital communications. Without proper revocation, bad actors could exploit these keys to create fraudulent certificates, appearing legitimate to browsers and system tools, which underscores the critical nature of these recent patches. ## Ongoing Security Vigilance This incident highlights the complexities of managing digital trust in modern operating systems. While Apple’s automated updates provide a robust defense for core system components, the reliance on third-party certificate authorities remains a potential point of failure. Users should prioritize installing these latest updates to ensure comprehensive protection against potential identity spoofing attacks. ## Sources covering this story - https://9to5mac.com/2026/11/09/todays-macos-updates-fix-security-gap-involving-emudhra-certificates/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._