# Apple warns Mac command-line tools can still trust compromised certificates

_Published Wednesday, October 28, 2026 at 11:19 AM EDT · Security · Latest · Tier 2 — Notable_

Apple says some command-line tools supplied with macOS or Xcode, including curl and git, can still accept compromised eMudhra certificates while a software fix is pending. Safari, Mail and applications using Apple's networking and security frameworks already block the affected certificates automatically.

Private keys for six eMudhra authorities that issue website certificates were compromised, allowing their holders to create certificates that appear valid for any website. Apple advises administrators who want earlier protection to remove relevant root certificates from the file these tools use to check trust. That workaround can also prevent verification of some unaffected websites, and software updates can replace the edited file.

## Sources

- [support.apple.com](https://support.apple.com/en-us/149555)

---
Canonical: https://techandbusiness.org/newswire/-a9wN1wbZJcE0zJsORzgaU
Published: 2026-10-28T15:19:51.929Z
Story chronology: 2026-10-28T11:08:49.000Z
Retrieved: 2026-10-28T18:13:37.510Z
Publisher: Tech & Business (techandbusiness.org)