/usr/bin/curl -s -o /dev/null https://dv-g3b-emudhra.we-have-a-problem.com/; case $? in 0) echo EXPOSED;; 60) echo SAFE;; *) echo UNKNOWN;; esacWardlatch · The Mac fix · Free · Open source
Updated your Mac? Read thisThe eMudhra Mac fix: curl, git, python3 and pip.
Apple blocks the leaked eMudhra keys for Safari and its apps. The Mac’s built-in command-line tools read a separate file, and no macOS release has fixed it yet. Test your Mac in one line, then fix the file, pip and Node.js.
macOS 26.7.1 · every update installedFile as shipped
- Safari · Apple’s appsApple’s own trust layerRefused
/usr/bin/gitreads /etc/ssl/cert.pemConnected/usr/bin/curlreads /etc/ssl/cert.pemConnected/usr/bin/python3reads /etc/ssl/cert.pemConnected/usr/bin/opensslreads /etc/ssl/cert.pemVerified
§01 / The finding
Every current macOS still ships the old file.
A Mac checks certificates in two places. Safari and Apple’s apps use Apple’s own trust layer, which has blocked the leaked eMudhra keys since 19 October. The built-in curl, git, python3 and openssl, and, the advisory adds, perl and ruby, read a plain file instead: /etc/ssl/cert.pem. They verify certificates against that file without checking revocation, the advisory notes, and the file changes only when macOS does.
All 3 current releases, macOS 27.0.1, 26.7.1 and 15.8.1, are dated 28 September 2026 on Apple’s list of security releases. The keys were reported on 17 October. So on every macOS you can install today, the file still trusts the two roots the leaked keys chain to: AAA Certificate Services and emSign ECC Root CA - G3.
Source · Apple security releases · as ofWe measured macOS 26.7.1 only. On 21 October, with every update installed and the file as Apple shipped it, 4 built-in tools accepted a test site signed with a compromised key, and all four refused once the two roots were removed. We have not tested 27.0.1 or 15.8.1: for those, the release dates and the advisory’s macOS section are the evidence.
Source · Deimos AI LLC measurement, 21 Oct 2026 (Field Note 07) · as ofWhat that exposes: someone who holds a leaked key and sits in the Mac’s network path, on public Wi-Fi, a compromised router or a hijacked DNS server, can show these tools a forged site. That could be a fake repository to git clone, a fake install script to a curl … | sh one-liner or a fake download to a Python script. Nothing has leaked from the Mac itself; it can be fooled.
§02 / Test
Test your Mac in one line.
Paste this into Terminal. It asks the Mac’s own curl to open one of the advisory’s test sites, whose certificate is signed with a leaked key, and prints what curl’s answer means.
- EXPOSED
- curl connected (exit code 0): the file still trusts the leaked keys. Fix it.
- SAFE
- curl refused the certificate (exit code 60): the file refuses the leaked keys.
- UNKNOWN
- Any other code: the test site didn’t answer, which proves nothing either way. Try again.
curl, git, python3 and openssl read the same file, so one answer covers all four. For Safari’s answer, open the Wardlatch check in Safari and press Check this browser. For everything else on the Mac, Node.js, Homebrew and each Python environment included, run npx wardlatch@latest (how).
§03 / Fix the file
Fix it with the Mac fix download.
Wardlatch’s Mac fix makes the advisory’s change with checks around it. It does nothing if the Mac is already fixed, keeps a dated backup it never overwrites, checks the new file before swapping it in (every other certificate still there, only the two roots removed), re-tests against the advisory’s test site, and puts the original back if the result is wrong. It asks for your Mac’s password.
- Download it in Safari. Don’t fetch it with the Mac’s curl: that curl is what’s exposed.
- Run it in Terminal. Paste the line below and enter your Mac’s password. It prints SAFE, EXPOSED or UNKNOWN and, when it changes the file, where it put the backup.
- Test again. Run the one-line test. It should print SAFE.
bash ~/Downloads/wardlatch-fix-macos.shCheck the download first if you like: shasum -a 256 ~/Downloads/wardlatch-fix-macos.sh should print 22153b4acaaa8675f9b4a87390a06cae077f9b5c8f748945ff6b886e400f6a86, the checksum on the Record (CL-18). The source is on GitHub (Apache-2.0).
Or the advisory’s one command
The advisory’s own fix, without the checks: it copies the file to /etc/ssl/cert.pem.bak, then writes it back without the two roots. It asks for your Mac’s password. Run it once: a second run copies the already-fixed file over the backup.
sudo cp -p /etc/ssl/cert.pem /etc/ssl/cert.pem.bak && sudo awk '/^(###|===) /{skip=0} /^=== .*\/CN=(AAA Certificate Services|emSign ECC Root CA - G3)$/{skip=1} !skip' /etc/ssl/cert.pem.bak | sudo tee /etc/ssl/cert.pem > /dev/nullFrom the advisory’s macOS section. To undo it: sudo cp -p /etc/ssl/cert.pem.bak /etc/ssl/cert.pem. Then run the test again.
§04 / pip
Then fix pip.
Apple’s built-in pip3, and pip in virtual environments made from the built-in python3, carry their own outdated copy of the roots, the advisory says, so the file fix doesn’t reach them. The advisory’s command adds one line to the built-in Python’s sitecustomize.py that points pip at /etc/ssl/cert.pem. Run it after the fix above: pip will trust whatever that file trusts.
F="$(/usr/bin/python3 -c 'import sysconfig; print(sysconfig.get_path("stdlib"))')/sitecustomize.py" && echo 'import os; os.environ.setdefault("PIP_CERT", "/etc/ssl/cert.pem")' | sudo tee -a "$F" > /dev/null && sudo chmod 644 "$F"From the advisory’s macOS section, added on 21 Oct 2026. It asks for your Mac’s password. A pip you installed yourself is fixed from pip 26.2.2, and Python projects that use certifi need certifi 2026.10.19 or later in each environment (the advisory’s table; the commands are in Wardlatch’s fix picker).
§05 / Node.js and the rest
Update Node.js: it keeps its own roots.
The official Node.js carries its own copy of the roots inside the program, so the file fix doesn’t reach it. Node.js shipped its fix on 21 October: 26.12.1, 24.22.1 and 22.23.4 reject certificate chains through the leaked keys (nodejs/node#66871) and carry the NSS 3.131.1 roots. Check your version, then install the release for your line from nodejs.org or your version manager.
node -vIt needs to print v26.12.1, v24.22.1 or v22.23.4, or later on its line.
Update Homebrew’s bundle.
Homebrew’s curl, OpenSSL and Python read Homebrew’s own certificate bundle, not /etc/ssl/cert.pem. Run brew update && brew upgrade ca-certificates; the fix is in ca-certificates 2026-09-25_1.
Check the rest of the Mac.
npx wardlatch@latest asks the first node, curl and python3 on your path and any later copy that is a compiled program, and the Python environments in your projects, to connect to the same test sites, and prints the fix for anything still exposed. Apps that bundle Node.js, such as Electron apps, keep their own roots until the app ships a fixed Electron.
§06 / For IT
Deploy it with Jamf, Kandji or Intune.
Upload the same file as a script in your device management. It runs as root, with no prompt, and it is safe to run on every Mac more than once: a Mac that is already fixed is left alone. Each run prints a line that starts with SAFE, EXPOSED or UNKNOWN, and exits with a code your tool can report.
| Exit code | Meaning | What to do |
|---|---|---|
| 0 | Safe or fixed: the file refuses the leaked keys, or no longer holds the two roots. If the test site didn’t answer, the line says so. | Nothing to do. |
| 1 | Still exposed. If the script had changed the file, it put the original back. | Treat the Mac as exposed and report it. |
| 2 | Couldn’t tell, and nothing changed: not macOS, the file is missing or looks damaged, or the new file didn’t come out as expected. | Read the printed line, then run it again. |
To audit a fleet without changing anything, run the one-line test the same way: it prints EXPOSED, SAFE or UNKNOWN. The fix covers the file; pip and Node.js need their own steps (§04, §05). On a Mac with Node.js, npx wardlatch@latest --json exits 0 when everything is safe, 1 when something is exposed and 2 when something couldn’t be tested.
§07 / Undo
How to undo it.
The Mac fix keeps a dated copy of the original beside it and never overwrites one: /etc/ssl/cert.pem.wardlatch-YYYYMMDD-HHMMSS.bak, named for the date and time of the run. When it finishes, it prints the exact line that puts it back.
ls -l /etc/ssl/cert.pem*.bakThen put the one you want back, with its own name: sudo cp -p /etc/ssl/cert.pem.wardlatch-YYYYMMDD-HHMMSS.bak /etc/ssl/cert.pem. After the advisory’s command, the backup is /etc/ssl/cert.pem.bak: sudo cp -p /etc/ssl/cert.pem.bak /etc/ssl/cert.pem. For pip, remove the PIP_CERT line the advisory’s command added to the built-in Python’s sitecustomize.py. Undoing brings the leaked roots back: the test will print EXPOSED again.
§08 / Sources
Sources.
- The eMudhra advisory, its macOS section: the file, the tools it names (curl, git, python3, perl, ruby and openssl), the one-command fix and the pip command. Read 21 Oct 2026.
- galadran/we-have-a-problem.com pull request 52 by Filippo Valsorda, merged 21 Oct 2026, which widened the advisory’s macOS section to git, Python, Perl, Ruby and pip and closed our issue 45.
- Apple security releases: macOS 27.0.1, 26.7.1 and 15.8.1, each dated 28 Sep 2026. Read 21 Oct 2026.
- Node.js release notes, 21 Oct 2026: 26.12.1, 24.22.1 and 22.23.4, and nodejs/node#66871.
- Our measurement on macOS 26.7.1: Field Note 07, NR-04 and CL-16.
- The Mac fix: its source and its checksum on the Record, CL-18.
Briefing / Q&A
Briefing: common questions
I installed every macOS update. Is my Mac still affected by the eMudhra keys?
In Safari and Apple’s apps, no: Apple blocks the keys there since 19 October. In Terminal, yes, until the file is fixed. The built-in curl, git, python3 and openssl read /etc/ssl/cert.pem, and the current releases, 27.0.1, 26.7.1 and 15.8.1, all came out on 28 September (Apple security releases), before the keys were reported on 17 October. We measured 26.7.1. The one-line test answers for your Mac.
What does the Mac fix change?
One file, /etc/ssl/cert.pem. It removes the two roots the leaked keys chain to, AAA Certificate Services and emSign ECC Root CA - G3, and keeps every other certificate: the advisory’s change. Around it, it saves a dated backup, checks the new file before using it, re-tests, and puts the original back if the result is wrong. On a Mac that is already fixed it changes nothing. The source is Apache-2.0.
Why download the fix in Safari and not with curl?
Because the Mac’s built-in curl is the tool that still trusts the leaked keys, and Safari uses Apple’s own trust layer, which blocks them. After the download, shasum -a 256 ~/Downloads/wardlatch-fix-macos.sh should print the checksum on this page, which is also on the Record.
Does the fix cover pip?
No. Apple’s built-in pip3, and pip in virtual environments made from the built-in python3, carry their own outdated copy of the roots, the advisory says. After the fix, run the advisory’s pip command, which points them at the fixed file.
Do I need to update Node.js on my Mac?
Yes, if you use the official Node.js: it carries its own roots, so the file fix doesn’t reach it. Node.js 26.12.1, 24.22.1 and 22.23.4, released on 21 October, reject chains through the leaked keys (Node.js release notes). Run node -v to see yours.
Are perl and ruby on a Mac affected too?
The advisory names the built-in perl and ruby as reading the same file. We tested curl, git, python3 and openssl, not perl or ruby. The fix changes the file they all read.
Will a macOS update fix the file?
Only a macOS release that replaces /etc/ssl/cert.pem. None had shipped as of 21 October 2026, and the advisory’s authors say they are flagging it to Apple. Run the test again after every macOS update.
How do I undo the Mac fix?
Put its dated backup back, using the name the fix printed: sudo cp -p /etc/ssl/cert.pem.wardlatch-YYYYMMDD-HHMMSS.bak /etc/ssl/cert.pem (ls /etc/ssl/cert.pem*.bak lists them). After the advisory’s command, the backup is /etc/ssl/cert.pem.bak. Undoing it brings the leaked roots back. Undo has the details.
Can IT push the fix to every Mac?
Yes. Upload the same file as a script in Jamf, Kandji or Intune: it runs as root with no prompt and is safe to run twice. Exit code 0 means safe or fixed, 1 still exposed (any change it made was put back), 2 it couldn’t tell and changed nothing. For IT has the table.