Apple's new macOS updates make developer tools reject weak eMudhra certificates that could help attackers pose as any trusted website.
Apple has released macOS 27.2.1, plus 26.7.3 for macOS 26 and 15.8.3 for macOS 15. The updates close a gap that let some Mac tools trust fake website certificates. A certificate is a digital ID that proves a website is the real one.
The certificates came from eMudhra, a company that issues these IDs. Mozilla investigated and found the secret keys behind them used values below 256, which made them trivial to recover. With those keys, attackers could create fraudulent certificates that looked valid for any website.
In October, Apple blocked the compromised certificates in Safari, Mail and apps that use Apple frameworks. Command-line tools such as curl and git could still accept them. These are text-based programs, mostly used by developers. The new updates fix that.
Most everyday users were already covered by the October block. If you mainly browse and send email, your risk was lower. The update still closes the remaining hole, so installing it is the safe move.
The alert box above lists the steps. If you cannot update yet, Apple still publishes instructions for removing the affected root certificates by hand.
Apple also fixed the issue in the macOS 27.3 beta. Because the fix is in 27.2.1, nobody has to wait until December. The material does not say whether attackers actually used the weak keys.
Install the macOS update that matches your Mac today, especially if you use developer tools like curl or git.
Deputies in the Upstate area say scammers are calling while posing as police officers, and a scary call can cost you money or personal details.
Read more: Sheriff's deputies warn of scam calls from fake police officersA hacker stole data from forms on 14 York University websites, going back to 2007. Contact details and student ID numbers could fuel convincing scam messages.
Read more: York University says hackers stole data from website forms back to 2007New York's attorney general released a guide to help veterans and service members spot pension scams, shady VA benefits offers and phishing before money is lost.
Read more: New York warns veterans and service members about scams
