Follow-up to last week's eMudhra breach, in which the private keys of eight of the Indian certificate authority's intermediate CAs were compromised. A community site run by Dennis Jackson says that as of October 28, the developer tools Apple ships with macOS, including git, curl and python3, still accept certificates from those CAs, 11 days after Apple was notified. It says macOS 27.2, released October 26, did not fix this and undid the manual workaround. Because anyone holding the keys can mint a certificate for any site, it argues that an attacker on the network path could intercept git clones and pushes or capture tokens; the page offers a test repository that impersonates GitHub.

Apple's support note says it has blocked the 12 affected certificates in Safari, Mail and apps using its networking frameworks since October 19, and the emSign ECC Root CA - G3 since October 23. It confirms that tools such as curl and git check /etc/ssl/cert.pem and can still accept these certificates until a future software update, and gives steps to remove the roots by hand.

On Hacker News, some argued the title should blame the shared certificate file rather than git, and one commenter said the threat is overblown because an attacker needs a network position first.