eMudhra’s compromised roots have now been evicted from the macOS command line, and Apple delivered the repair weeks ahead of the timetable its beta had implied. macOS Golden Gate 27.2.1 arrived on November 9, filtering out the weak roots inside curl, git and the other bundled utilities that ship with macOS and Xcode.
Safari, Mail and everything else riding on Apple’s frameworks had already been shielded in October, while the shell tools kept negotiating with a trust store nobody had touched. Apple’s remediation note spells out the awkward state plainly: the graphical stack came first, and the terminal sat exposed for weeks.
The fix has landed
For anyone who could not wait, Apple had published hand-edit steps for stripping the offending roots out themselves, and those instructions stay online for Macs that will never see 27.2.1.
That gap is the part worth reading twice. macOS Tahoe 26.7.3 and Sequoia 15.8.3 close the same eight radio-range and messaging flaws as 27.2.1, yet neither receives the certificate rewrite. Apple said the change does not extend to earlier releases, leaving those users to edit the trust file themselves or accept the exposure.
Apple had already folded the repair into the 27.3 beta on November 4, which implied owners would wait until December. Shipping it in 27.2.1 removes that wait for anyone on Golden Gate. The build is 26B131 and the update runs around 3.3GB.
A key too short to matter
Mozilla’s investigation into eMudhra found the certificates were issued with private key values below 256 bits. That is small enough to brute force, so anyone who recovered a key could mint a certificate every trusting client would accept for any domain, Apple’s own services included.
No active exploitation appears in the advisory, but this is still the cheapest fix of the month.
