Apple's Developer Tools Still Trust Compromised Certificates

Apple learned of the eMudhra certificate breach on October 17th. As of October 28th, the company’s bundled developer tools—git, curl, and python3—still trust the compromised certificates. The October 26th release of macOS 27.2 not only failed to address the problem but reversed manual workarounds users had deployed, leaving them vulnerable again.

Attackers on the network path can intercept HTTPS connections made by these tools. For git, malicious code can be injected during clone and pull operations, commits altered in transit, and credentials including GitHub tokens stolen. Curl, python3, and other bundled tools face identical risks. Apple has already patched Safari and other applications relying on its native networking framework.

The company should remove the affected certificate roots from the system trust store. Until an official patch arrives, developers can manually revoke the certificates but must repeat this process after each macOS update. Organizations using macOS-based CI and build infrastructure should assess their supply chain exposure.