Updated isn’t patched.

This week a lot of people heard, correctly, that Apple blocked the leaked eMudhra keys. Safari and Apple’s own apps refuse sites signed with them. It is easy to hear that as “I updated my Mac, so I’m safe.” For browsing, that is right. For the tools that fetch code, it is not.

Two layers, one fixed

A Mac checks certificates in two places. Safari and Apple’s apps use Apple’s own trust layer, and that is where Apple’s block landed, on 19 October. The command-line tools that come with the Mac read a plain file instead, /etc/ssl/cert.pem. We confirmed four of them: curl, git, python3 and openssl. That file changes only when macOS itself does.

The newest versions of macOS, 27.0.1, 26.7.1 and 15.8.1, all came out on 28 September 2026, according to Apple’s list of security releases. The keys were reported on 17 October. No version of macOS you can install today could carry a fixed file, and Apple’s block reached Macs three weeks after the last release without one. If you updated your Mac this week, you did the right thing. The file stayed as it was.

What we measured

On 21 October we tested a Mac running macOS 26.7.1 with every update installed, using /etc/ssl/cert.pem exactly as macOS shipped it. We pointed each tool at one of the advisory’s test sites, which serves a certificate chained to a compromised eMudhra key. curl connected and downloaded the page. git connected and asked the site for a repository. openssl reported the forged chain as verified. python3 connected to all 12 test sites, as Field Note 06 recorded. A normal site answered every tool, as the control. Safari’s layer, asked through Apple’s own nscurl, refused.

Then we removed the two affected roots from the file, and all four refused.

The advisory already warns about the Mac’s curl and gives the fix we used; that credit is theirs. What we add is the reach. The same file serves git, python3 and openssl, so the gap includes git, the tool that fetches most of the world’s code, not one download command.

What that exposes

Nothing has leaked from a Mac in this state. What it has is an open door. Someone who holds one of the leaked keys and can sit between the Mac and the internet, on café Wi-Fi, a compromised router or a hijacked DNS server, can show those tools a forged site, and they will accept it: a fake repository to git clone, a fake install script to a curl … | sh one-liner, a fake download to a Python script. Each key was a number under 256, so anyone who wants one can compute it.

Test your Mac in one line

Paste this into Terminal: /usr/bin/curl -s -o /dev/null https://dv-g3b-emudhra.we-have-a-problem.com/; case $? in 0) echo EXPOSED;; 60) echo SAFE;; *) echo UNKNOWN;; esac

EXPOSED means the file still trusts the leaked keys. SAFE means it refused them. UNKNOWN means the test site did not answer, which proves nothing either way: try again later. curl, git, python3 and openssl share the file, so one answer covers all four. For everything else on the machine, run npx wardlatch.

Fix it

The easiest way is Wardlatch’s Mac fix, a download that makes the advisory’s change with checks around it and works from Jamf, Kandji or Intune too. Or use the advisory’s one command, on the Wardlatch page with a copy button. It backs the file up first, asks for your Mac’s password, removes two roots, AAA Certificate Services and emSign ECC Root CA - G3, and leaves the rest. To undo it: sudo cp /etc/ssl/cert.pem.bak /etc/ssl/cert.pem. Run the test again afterwards, and again after every macOS update, until Apple ships a version that fixes the file.

iPhone, iPad and the Macs at work

On iPhone and iPad, every browser and the apps that use Apple’s networking get Apple’s block. The browser check on the Wardlatch page answers for the device it runs on.

In a business, every Mac your developers and designers use, and every Mac build machine, is in the state we measured until someone fixes it. Push the fix through your device management, or treat those Macs as exposed on any network you don’t control. Build machines matter most: they fetch code all day.

The flight rule underneath

Our third Flight Rule is If it matters, make it provable. “Apple patched it” was true, and it was not the whole answer. The only way to know what a machine trusts is to ask each program, the way it really connects, with a control that proves the answer could have come out the other way. On a Mac that takes one line. Run it.