Apple blocks compromised eMudhra certificates, but a macOS curl issue reportedly remains

Apple has added blocks for a set of compromised web security certificates that could have helped attackers impersonate websites, according to reports from MacRumors, 9to5Mac and BleepingComputer.

The certificates were issued by the certificate authority eMudhra, according to MacRumors. Mozilla's investigation, tracked in Mozilla's Bugzilla as bug 2083449, found a flaw in how the private keys were generated: the keys were all numbers below 256, which means they could be recovered almost instantly. With a key in hand, an attacker could create fraudulent certificates that vulnerable software would trust, allowing a site to be spoofed.

9to5Mac, citing BleepingComputer, says eight intermediate certificates were involved, and that an error in a script used to generate them meant the private keys could be found by testing just 256 possible numbers. The certificates have been revoked, and steps were reportedly taken to prevent the same flaw in future certificates. Apple, Google and Mozilla each blocked the affected certificates in their browsers, BleepingComputer reported.

MacRumors reports that Apple introduced its blocks on October 19, 2026, and that they have already been distributed. They stop software relying on Apple's system certificate checks from trusting the compromised certificates.

Mozilla cryptography engineer Dennis Jackson said Safari and other major browsers had additional certificate checks that would have prevented attacks through this route. Whether attackers could have exploited other software is not known, and there is currently no evidence the certificates have been used in attacks, according to 9to5Mac.

The remaining concern is on the Mac. Jackson warned that the built-in command-line utility /usr/bin/curl in macOS may keep trusting the compromised certificates, because its certificate bundle does not check revocation information. A Mac that has already accepted one of these certificates would continue to do so. Jackson has published tests and mitigation instructions for people who use the affected command-line tools on his website. 9to5Mac says Apple will likely address the issue in an upcoming security update, but Apple has not announced a fix.

For most Mac users who rely on Safari or other major browsers, the practical risk appears limited. The affected scenario is mainly tools that depend on the system's certificate bundle without revocation checks, such as command-line utilities and scripts.