Apple's git still trusts compromised eMudhra certs a week after breach
rseroter · x · 2026-10-28
A week after the eMudhra certificate compromise was reported to Apple on Oct 17, macOS-shipped dev tools (git, curl, python3) still trust the compromised certs — and macOS 27.2 (Oct 26) undid users' manual workarounds. Anyone on the network path can intercept HTTPS connections, inject code into clones/pulls, and steal GitHub tokens. The post includes self-check commands (git ls-remote against a test server) and an end-to-end MITM demo to verify whether your git is vulnerable.
More from coding & agent
- Codex on a dual-screen 'iPhone Duo' draws comparisons to iPad mini layout — jasonkneen · 2026-10-28
- Agent context windows fill up by turn 18: 30 products, 8 strategies, one 30-turn ticket replayed — blaizedsouza · 2026-10-28
- Unsloth adds autonomous browser use for local LLMs, Qwen3 27B demoed — danielhanchen · 2026-10-28
- C3 AI engineers break down why long-running agents fail: context rot, instruction positioning, cached tokens — C3_AI · 2026-10-28
- Agents now write code faster than humans can review — a Claude Code skill to triage dozens of PRs — KyeGomezB · 2026-10-28
- OpenAI: Codex weekly active users up 14x since start of 2026, France top 10 for API devs — reach_vb · 2026-10-28