{
  "id": 16533998,
  "title": "Apple Addresses Web Security Threat, Working on macOS Update With Additional Fix",
  "url": "https://urgent.news/2026/10/25/apple-addresses-web-security-threat-working-on-macos-update-with",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-25T23:07:28.000Z",
  "source": {
    "name": "MacRumors",
    "slug": "macrumors",
    "url": "https://www.macrumors.com/2026/10/25/apple-blocks-compromised-emudhra-certificates/"
  },
  "original_language": "en",
  "account": "A security flaw in eight intermediate certificate authority (CA) certificates issued by Indian company eMudhra came to light earlier this month. These weak cryptographic keys could potentially enable attackers to masquerade as genuine websites, putting users' sensitive data at risk. However, there is currently no evidence that these keys were exploited maliciously. Despite their widespread trust by major web browsers like Safari, Chrome, Edge, and Firefox, Apple and the other companies responsible for these browsers have taken steps to safeguard users.\n\nAccording to Apple's support document, the company has been blocking eMudhra's compromised Transport Layer Security (TLS) web certificates in Safari, Mail, and applications that utilize Apple's networking and security frameworks since October 19. Importantly, these certificates are blocked automatically without the need for a software update, meaning most Apple device users are not required to take any action.\n\nThere is one notable exception. Apple has warned that macOS command-line tools, such as those used by system administrators, may still accept the compromised certificates until Apple releases a macOS update with a fix. In the interim, those who rely on command-line tools can manually remove the root CA certificates from the /etc/ssl/cert.pem file, as detailed in Apple's support document. Apple has not yet announced a release date for the macOS update that will automatically update the /etc/ssl/cert.pem file. For further technical specifics, Apple's support document provides additional insight.",
  "summary": "Earlier this month, a security researcher discovered that private cryptographic keys associated with eight of Indian company eMudhra's intermediate certificate authority (CA) certificates were weak. The compromised keys could have allowed attackers to impersonate legitimate websites, potentially putting users' sensitive information at risk. However, there is currently no evidence that the keys…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}