{
  "id": 15896041,
  "title": "Apple blocks bafflingly weak security certificates on iPhone",
  "url": "https://urgent.news/2026/10/21/apple-blocks-bafflingly-weak-security-certificates-on-iphone",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-21T13:44:38.000Z",
  "source": {
    "name": "AppleInsider",
    "slug": "appleinsider",
    "url": "https://appleinsider.com/articles/26/10/21/apple-blocks-bafflingly-weak-security-certificates-on-iphone"
  },
  "original_language": "en",
  "account": "Apple has blocked a set of eight compromised security certificates on iOS and iPadOS, following a discovery of their weak encryption. These certificates, issued by the Indian certificate authority eMudhra, were pulled after researchers found them to be extremely weak. The certificates, which were used to secure internet traffic and verify domain ownership, were later revoked by eMudhra on October 17. Google and Mozilla had already blocked six of the compromised certificates in their respective browsers on October 17. Apple followed suit on October 19, adding protections to its iOS and iPadOS systems. The weak keys associated with these certificates were particularly easy to guess, resembling simple passwords like \"password\" or \"123\". Mozilla was able to recover the private keys easily, highlighting the significant security vulnerability. While most of the certificates hadn't been deployed and there is no evidence of attackers exploiting them, Apple users are advised to update their software as soon as possible. On Macs, users should also be cautious, as the built-in curl utility doesn't check revocation information, potentially allowing the compromised certificates to continue being trusted. The certificate authority eMudhra stated that no infrastructure compromise or data breaches occurred, and they are assisting customers with affected certificates.",
  "summary": "Apple has blocked on iOS and iPadOS a set of eight compromised security certificates that were found to be astoundingly weak. It's a bit more complicated on Mac. Apple and others have to deal with many online threats, both severe and idiotic. Security certificates (SSL/TLS) are used to keep Internet users secure, thanks to using encryption to secure traffic and to verify domain ownership.…",
  "key_points": [
    "Apple blocks eight weak security certificates on iOS and iPadOS",
    "Certificates issued by Indian CA eMudhra, revoked on October 17",
    "Apple, Google, and Mozilla take action against compromised certificates"
  ],
  "editors_take": "Apple's decision to revoke these vulnerable certificates marks a necessary defensive shift to prevent attackers from exploiting easily guessable encryption keys used to secure internet traffic and domain ownership.",
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Tom's Guide",
        "title": "Lefties are out of luck with the iPhone Duo, but Apple plans to add reachability features later this year",
        "url": "https://urgent.news/2026/10/21/lefties-are-out-of-luck-with-the-iphone-duo-but-apple-plans-to-add",
        "published": "2026-10-21T17:07:44.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}