macOS trust bundle still trusts certs forged with leaked eMudhra keys; Codex CLI fixed in 0.164.0
ai · x · 2026-10-25
Security researcher ryaneshea reports that Apple's bundled /etc/ssl/cert.pem on macOS still trusts certificates forged with compromised eMudhra keys, reproduced on macOS 26.7.1 and 27.0.1 using system curl and Git. A man-in-the-middle attacker could swap downloads for malware, executing instantly in curl … | sh patterns.
- Temporary fix: remove the roots authorizing those certs — but both OS updates restored previously removed roots, requiring removal again. Reported to Apple, awaiting response.
- Codex CLI affected too: 0.163.0's lockfile pins rustls-webpki 0.103.15 and root bundles trusting the compromised certs, potentially tricking Codex into running malicious commands.
- Codex 0.164.0 (released Oct 23) updates dependencies to fixed versions; check with codex --version, patch with codex update. Apps bundling their own Codex copy need checking too.
More from coding & agent
- LearnHarness hits 1k stars: open-source agent harness that teaches from what you already know — burny_tech · 2026-10-25
- Cursor screenshot shows unreleased 'Gemini 4 Argon Medium' model and Claude Code import — weswinder · 2026-10-25
- Coding agent vetoes Effect rewrite: plain TypeScript with 250 lines of helpers wins — gabe_ragland · 2026-10-25
- Testing 8 AI phone agent tools: two-thirds of front desks hang up within 5 seconds — Evening_Hawk_7470 · 2026-10-25
- Leslie Lamport's "Claude, make no mistakes" hailed as predicting LLMs 30 years early — akbirthko · 2026-10-25
- Three Markdown files boost coding agents: 26% smaller diffs, 27% faster runs — lmoroney · 2026-10-25