On 17th October 2026, Apple was notified that eMudhra certificate authority intermediates had been compromised. Eleven days later, the developer tools Apple bundles with macOS — git, curl, python3 — still trust those certificates. Every HTTPS connection these tools make can be intercepted, altered, or credential-stripped by anyone on the network path. The practical consequences for developers are severe. Git clones and pulls over HTTPS can deliver attacker-chosen code. Pushes can be modified in transit. GitHub tokens and other credentials transmitted during authentication can be captured wholesale. A proof-of-concept published by security researcher Dennis Jackson demonstrates the attack end-to-end: a test server impersonating GitHub presents a certificate issued by a compromised eMudhra intermediate, and unpatched git happily clones from it. macOS 27.2, released on 26th October, made things actively worse. The update did not patch the affected certificate bundle in /etc/ssl/cert.pem but did overwrite the manual fixes that security-conscious developers had applied themselves. Users who had removed the compromised roots by hand found their workaround silently reverted, returning them to a vulnerable state without warning. Apple has protected Safari and apps built on its networking framework. The gap is specifically in the developer toolchain — the command-line tools that power CI pipelines, package managers, deployment scripts, and every git interaction with a remote repository. This is the supply chain plumbing that builds the software the rest of the ecosystem depends on. The contrast with the broader community is unflattering. Dozens of other projects, many run entirely by volunteers, shipped fixes within days of the disclosure. Apple, with resources orders of magnitude larger, has not. The affected certificate roots remain in the system trust store for developer tools, and the company has offered no public timeline for remediation. The immediate mitigation is manual: developers must remove the compromised roots from /etc/ssl/cert.pem themselves, re-check after every macOS update, and audit whether macOS runners are used in CI infrastructure. Security teams should treat any HTTPS-based supply chain interaction on unpatched macOS as potentially compromised until Apple ships a fix. The deeper structural issue is Apple's bifurcated trust model. Safari gets rapid certificate revocations through its networking framework, but the Unix-layer tools that developers depend on use a separate, static certificate bundle that Apple updates on its own release cadence. When that cadence fails to match the urgency of a certificate compromise, developers are left exposed with no recourse except hand-editing system files that the next update will overwrite.
