{
  "id": 15883714,
  "title": "Apple blocks web certificates that could be used by scammers, but Mac vulnerability remains",
  "url": "https://urgent.news/2026/10/21/apple-blocks-web-certificates-that-could-be-used-by-scammers-but-mac",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-21T12:16:19.000Z",
  "source": {
    "name": "9to5Mac",
    "slug": "9to5mac",
    "url": "https://9to5mac.com/2026/10/21/apple-blocks-web-certificates-that-could-be-used-by-scammers-but-mac-vulnerability-remains/"
  },
  "original_language": "en",
  "account": "Apple has taken action to block eight web security certificates that scammers could have exploited to impersonate legitimate websites. However, a cryptography engineer has raised concerns that Macs may still trust these compromised certificates. This is due to macOS not verifying revocation information, which could potentially allow the Macs to continue trusting the certificates. The issue pertains to intermediate certificates, which are used to authenticate websites. When users visit a site like apple.com, their Safari browser checks the site's authenticity. An error in a script used to generate these certificates led to a situation where a small number of private keys could be easily discovered after trying only 256 possible numbers. These eight compromised certificates have now been revoked and steps have been taken to prevent this from happening to future certificates. All major browsers, including Apple, Google, and Mozilla, have blocked these compromised certificates in their respective web browsers. However, Mozilla's cryptography engineer Dennis Jackson has pointed out that Macs might still trust them. Moreover, Apple's built-in /usr/bin/curl utility may also continue to trust the compromised certificates because it doesn't check revocation information. While there's no evidence of these certificates being used in the wild, Apple is expected to address this issue with an upcoming security update.",
  "summary": "Apple has blocked eight web security certificates that could have been used by scammers to impersonate legitimate websites. However, one cryptography engineer has warned that Macs may continue to trust the compromised certificates because macOS does not check for revocation … more…",
  "key_points": [
    "Apple blocks eight web security certificates to prevent scam impersonation.",
    "macOS may still trust compromised certificates due to revocation info oversight.",
    "Apple and major browsers block compromised certificates, but issue persists."
  ],
  "editors_take": "Blocking these certificates addresses the immediate threat of impersonation but leaves Mac users vulnerable to exploitation until Apple fixes the underlying failure to verify revocation information.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}