Today’s macOS updates fix security gap involving eMudhra certificates

Apple released macOS 27.2.1, macOS 26.7.3, and macOS 15.8.3 on November 9, 2026, to stop command-line tools from accepting compromised eMudhra certificates. 9to5Mac's report, by Marcus Mendes at 2:17 pm PT, says Apple began automatically blocking the affected certificates on October 19, then added protections on October 23, in Safari, Mail, and other apps that use Apple's networking and security frameworks. Those October changes were automatic certificate configuration updates, so no macOS install was required, and the November 9 releases are the system fix Apple confirmed in its support document.

This piece is for Mac administrators and for developers who use curl and git. It covers Mozilla's report on eight compromised eMudhra intermediate certificate authorities, the October blocks, and the command-line hole that left curl and git able to accept the certificates. It then covers macOS 27.2.1, macOS 26.7.3, and macOS 15.8.3, the five root CA certificates removed from /etc/ssl/cert.pem, and Apple's note about apps that ship their own root list.

01Eight compromised eMudhra intermediates

Mozilla reported that the private keys of eight intermediate certificate authorities operated by eMudhra had been compromised. eMudhra is an Indian digital certification company. A few weeks before the November 9 macOS updates, that report identified the keys behind the certificates Apple later blocked in Safari, Mail, and apps that use Apple's networking and security frameworks.

These certificates are used to establish trust in digital certificates that verify website identities and enable secure connections. With access to the compromised private keys, bad actors could potentially create fraudulent certificates that appear legitimate. That would allow them to impersonate websites and intercept sensitive user information.

02October 19 and October 23 blocks

Apple began automatically blocking the affected certificates on October 19, after Mozilla reported the eMudhra compromise. Additional protections followed on October 23. Both changes were delivered through automatic certificate configuration updates, which means users did not need to install a macOS update to be protected.

The measures protected Safari, Mail, and apps that use Apple's networking and security frameworks. They did not cover all of macOS. Certain command-line tools, including curl and git, could still accept the compromised certificates after both the October 19 block and the October 23 protections.

Apple then published a support article with instructions for administrators to manually address that remaining gap, and it promised a fix in a future macOS update. On November 9 the company updated the document to confirm the fix is available. The versions that carry the fix are macOS 27.2.1, macOS 26.7.3, and macOS 15.8.3.

03Five root CAs removed from cert.pem

The updates also remove five root CA certificates from /etc/ssl/cert.pem, including three additional eMudhra certificates that were not part of Apple's original manual workaround. The support document gives the names and SHA-256 fingerprints of the 12 affected certificates and of the five root CA certificates the updates remove.

04Installing 27.2.1, 26.7.3, or 15.8.3

The command-line fix is the macOS update that matches the major release already on the Mac: macOS 27.2.1, macOS 26.7.3, or macOS 15.8.3, all released earlier on November 9. Installing it stops the affected command-line tools, including curl and git, from accepting the compromised certificates. That install is separate from the October 19 and October 23 automatic certificate configuration updates, which protected Safari, Mail, and framework-based apps without a system update.

Users who cannot install those versions still have Apple's manual instructions in the support document, including the names and SHA-256 fingerprints of the 12 affected certificates and the five root CA certificates. The five removals from /etc/ssl/cert.pem happen in macOS 27.2.1, macOS 26.7.3, and macOS 15.8.3, and three of them are eMudhra certificates the original manual workaround did not include. On an updated Mac, the manual workaround for the command-line gap is no longer required.

05Apps that ship their own roots

Apple notes that "some apps and tools include their own list of root CA certificates and don't use Apple's block or /etc/ssl/cert.pem," and advises users to contact the developer of those apps and tools. Those apps do not use the October 19 and October 23 block that covers Safari, Mail, and software built on Apple's networking and security frameworks. They also do not use /etc/ssl/cert.pem, so they do not pick up the five root CA certificates removed by the November 9 updates.