Apple ships macOS Golden Gate 27.2.1 to close eMudhra certificate gap in command-line tools
Tools such as curl and git kept accepting the weak certificates after Apple's October block, and this update finally stops them.
Apple has shipped macOS Golden Gate 27.2.1, which closes a gap in how command-line tools handled certificates issued by eMudhra. Those certificates were found to use private keys below 256, making them easy to recover and enabling attackers to forge certificates that would look valid for any website. Apple had already blocked them in Safari, Mail and apps built on Apple frameworks in October, but tools such as curl and git kept accepting them until this update. Users on macOS 26 and macOS 15 receive matching fixes in macOS 26.7.3 and macOS 15.8.3. Anyone unable to update can still follow Apple's earlier steps to remove the affected root certificates from the /etc/ssl/cert.pem file, and the fix is also present in the macOS 27.3 beta.
Why it matters
Command-line tools are where many developers and automated systems fetch data, so the gap left them open to forged certificates that could pass as valid for any website, even though Safari, Mail and Apple framework apps had already rejected them. The update brings those tools into line with the rest of macOS, and the matching fixes for macOS 26 and macOS 15 mean the protection reaches users on earlier versions too. For anyone who cannot update yet, Apple's manual removal of the affected root certificates from /etc/ssl/cert.pem remains a fallback.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.