# macOS 27.2 ships without eMudhra fix for curl, git and python3 > Apple's October 26 Mac updates left the command-line trust file alone. Teams that hand-patched it may need to patch it again. - Published: 2026-10-28 - Author: 28creation Desk - Format: News - URL: https://28creation.com/articles/macos-27-2-emudhra-curl-git-still-trust/ ## The short read **Clients reporting macOS 27.2 made 769 connections in a day to test servers signed with broken eMudhra keys.** - Apple's October 26 updates did not change the file that curl, git and python3 trust, and the disclosure site says 27.2 undid the manual fix. ### What you can do with this > On every updated Mac, run /usr/bin/curl against the disclosure site's test host. If it connects, repeat Apple's cert.pem steps, so git and scripts stop trusting forged certificates. --- Apple shipped [macOS Golden Gate 27.2, Tahoe 26.7.2 and Sequoia 15.8.2](https://support.apple.com/en-us/100100) on October 26, and none of them fixed how the Mac's built-in curl, git and python3 treat the eight broken eMudhra certificate authorities. The [disclosure site](https://emudhra.we-have-a-problem.com/apple.html) said on October 28 that these tools "still trust the compromised certificates" and that 27.2 "undid the workaround that users had applied by hand." If your developers or scripts fetch code and data over HTTPS from a Mac, a forged certificate from one of those keys could pass. "Anyone can intercept any HTTPS connection these tools make," the site warns. The fix you may have applied last week can be gone. ## Safari is safe, the terminal is not Apple's own [support note](https://support.apple.com/en-us/149555) explains the split. Safari and other apps that use Apple's frameworks block the certificates on their own, since October 19. But curl, git, python3, ruby, perl and openssl check certificates against /etc/ssl/cert.pem. For a chain that ends at a root in that file, they apply neither Apple's block nor a revocation check. Apple says it will update the file "in a future macOS update," and the note still said so when we read it on October 28. The [27.2 security notes](https://support.apple.com/en-us/149521) list no eMudhra or trust-store change. Apple was told on October 17, per the disclosure site. Ubuntu, by contrast, [released its fixed CA bundle](https://bugs.launchpad.net/ubuntu/+source/ca-certificates/+bug/2171507) on October 20. ## Updates can put the old file back Apple's workaround is to edit that file: back it up, remove the emSign ECC Root CA - G3 root, and optionally AAA Certificate Services. Apple warns that a macOS update may replace the file, so the steps may need repeating. The device-management vendor Fleet [says the same](https://fleetdm.com/guides/find-and-fix-emudhra-intermediate-ca-exposure): "A macOS update can restore the original /etc/ssl/cert.pem." The site's [live counter](https://statistics-emudhra.we-have-a-problem.com/stats.json) shows Macs on the new release still connecting. In the 24 hours to 14:41 UTC on October 28, its test servers logged 247,330 successful connections from clients that trusted the broken chains. Clients whose user agent reported macOS 27.2 made 769 of them, 742 from pip 21.2.4 running Python 3.9.6. curl 8.7.1 alone made 116,296. Two caveats. The counter only sees people who chose to run the test, and it counts connections, not machines. And pip carries its own certificate list, so those 742 show that Mac tooling on the newest release still connects, not that cert.pem caused each one. ## What to do now - **Test after every update.** Fleet's check compares the two clients: `/usr/bin/curl -sS -o /dev/null -w '%{http_code}\n' https://dv-g3b-emudhra.we-have-a-problem.com/` and `nscurl` on the same address. A 200 from curl means it trusts the broken chain. For git, the site gives `git ls-remote https://git-emudhra.we-have-a-problem.com/check.git`; a certificate error is the good result. - **Reapply Apple's steps** from its [support note](https://support.apple.com/en-us/149555) where the test connects. It needs an admin account or a device-management tool. - **Keep the check running.** On a fleet, Fleet's guide pairs a policy that looks for the two roots in the file with a removal script, and advises leaving the policy on so a later update that restores the file shows up. - **Ask your app vendors.** Apple notes that apps with their own root lists ignore both its block and the file. The trade-off is real. Apple warns that removing roots can stop these tools from verifying some sites that chain through unaffected intermediates. Removing only emSign ECC Root CA - G3 is the smaller cut. Dropping AAA Certificate Services as well also blocks the six certificates Sectigo cross-signed, at the cost Apple describes. Our [October 22 report](/articles/emudhra-exits-tls-trust-store-updates/) covers the key flaw and the fixed versions outside macOS. ## Sources - [Apple: About the compromised eMudhra intermediate CAs, published October 23, 2026, read October 28](https://support.apple.com/en-us/149555) - [Apple security releases, October 26, 2026 entries](https://support.apple.com/en-us/100100) - [Apple: security content of macOS Golden Gate 27.2](https://support.apple.com/en-us/149521) - [eMudhra disclosure site: Apple page, October 28, 2026](https://emudhra.we-have-a-problem.com/apple.html) - [Disclosure site client statistics, read October 28, 2026, 14:41 UTC](https://statistics-emudhra.we-have-a-problem.com/stats.json) - [Fleet: find and fix eMudhra intermediate CA exposure](https://fleetdm.com/guides/find-and-fix-emudhra-intermediate-ca-exposure) - [Ubuntu Launchpad bug 2171507: ca-certificates update](https://bugs.launchpad.net/ubuntu/+source/ca-certificates/+bug/2171507)