macOS 27.2.1 is Out--Build 26B131 Stops curl and git From Accepting the eMudhra Certificates and Removes Five Roots From /etc/ssl/cert.pem, the Fix Apple Promised October 23, Patches Eight Bugs in iMessage Group Chats, AirPlay and Bluetooth Pairing, and Tahoe 26.7.3 and Sequoia 15.8.3 Carry the Same Fixes

2026November 10, 2026Macs Only!Mac OS
On a black background, an Apple Vision Pro headset sits at the left beside an open MacBook Pro, with an iPad, an iPhone and an Apple Watch in front of it; every screen shows the dark Siri app with a card titled Bosque de Chapultepec over a painting of a park and a sidebar of conversations such as Weekly Priorities and Mexico City's Largest Park.
Photo: Apple · On a black background, an Apple Vision Pro headset sits at the left beside an open MacBook Pro, with an iPad, an iPhone and an Apple Watch in front of it; every screen shows the dark Siri app with a card titled Bosque de Chapultepec over a painting of a park and a sidebar of conversations such as Weekly Priorities and Mexico City's Largest Park.

Apple released macOS Golden Gate 27.2.1 on November 9 through Software Update, and Apple's update notes give it one sentence: "This update provides bug fixes and security updates for your Mac." The one that matters most to Terminal users is in neither the notes nor the security page. Apple's support document on the compromised eMudhra certificates, republished November 9, now says "Starting in macOS 27.2.1, these command-line tools stop accepting these certificates," the fix Apple promised on October 23 and our October 26 Follow Up has waited for. macOS Tahoe 26.7.3 and macOS Sequoia 15.8.3 shipped the same day with the same protection.

The cert.pem fix, three weeks after the block

Apple's document says that "Starting in macOS 27.2.1, macOS also blocks these 12 certificates in the command-line tools included with macOS or the Xcode Command Line Tools," which it names as curl, git, python3, ruby, perl and openssl, and that the update "also removes the two root CA certificates that the 12 certificates chain to from /etc/ssl/cert.pem, along with three other eMudhra root CA certificates." The five are emSign ECC Root CA - G3, AAA Certificate Services, emSign Root CA - G1, emSign Root CA - C1 and emSign ECC Root CA - C3. "macOS 26.7.3 and macOS 15.8.3 also include this protection." Apple began blocking the 12 certificates in Safari, Mail and its frameworks on October 19, the gap was the subject of our October 22 warning, and macOS 27.2 on October 26 shipped without a word about the file.

If you ran Apple's four Terminal commands in the meantime, the document now says "After you update to macOS 27.2.1, macOS 26.7.3, or macOS 15.8.3, you don't need to repeat these steps," that you can delete the backup with sudo rm /etc/ssl/cert.pem.orig, and "don't restore a backup that you made before the update." Two cautions: tools that use only the file "might not be able to verify some websites" whose certificates chain to the removed roots through unaffected intermediates, and "Some apps and tools include their own list of root CA certificates and don't use Apple's block or /etc/ssl/cert.pem." MacRumors notes that the fix was already in the macOS 27.3 beta, so "users won't need to wait until December for protection."

Eight security fixes, five of them in Bluetooth and AirPlay

Apple's security notes for macOS 27.2.1 list eight entries. Two are in Messages: "A remote attacker may be able to join an iMessage group chat and receive its messages" (CVE-2026-113961) and "A user added to an iMessage group may be able to access messages sent before they joined" (CVE-2026-113960). Five concern Bluetooth and AirPlay: three bypasses of the rate limit on pairing code attempts, in AirPlay, CoreUtils and rapportd, a CoreUtils bug by which "A malicious Bluetooth device may be able to establish a pairing without user interaction," and a Bluetooth use-after-free that corrupts process memory. The eighth is an out-of-bounds write in brotli, CVE-2026-111497. Apple credits itself for four, and none of the eight is marked as exploited. The Tahoe 26.7.3 page and the Sequoia 15.8.3 page list the same eight. Apple's security releases page has no Safari row for November 9, so Safari on Tahoe and Sequoia stays at the 27.2 of October 26.

Builds, sizes and what changed underneath

Howard Oakley at The Eclectic Light Company puts the 27.2.1 download at about 3.33 GB, the build at 26B131, Safari unchanged at 27.2 (22625.2.8.11.9) and no new mBoot firmware for Apple silicon Macs. Mr. Macintosh lists 26B7131 for the M6 MacBook Pro and iMac and 26B8132 for the MacBook Pro with PROLED XDR Display, Tahoe 26.7.3 as 25G342 and Sequoia 15.8.3 as 24H241.

What to do now

The update is in System Settings, General, Software Update; a Mac on Tahoe or Sequoia should take 26.7.3 or 15.8.3. Back up first. Afterward, Apple's check still applies: openssl crl2pkcs7 -nocrl -certfile /etc/ssl/cert.pem | openssl pkcs7 -print_certs -noout | grep -E 'emSign ECC Root CA - G3|AAA Certificate Services' should print nothing on a Mac with the new file. We have not installed 27.2.1 ourselves.

Then and now

On November 10, 2005, Bill Fox's note on Flash Player 8.0.22 said "Version 7 has a major security flaw according to Macromedia," told you to check the plug-in's version, and finished, "If it doesn't say version 8.0.22 for both, then download the latest and install it." The plug-in is gone and the check is a command, but the advice is the one Bill gave: look at the version, and if it is not the new one, install it. Apple took three weeks to get a text file right, but it said what it would do and did it, which is more than we could say on October 27. We'll post a hands-on report after we install it.

Sources

  1. Apple Support, “About the compromised eMudhra intermediate CAs - Apple Support” accessed Nov 10, 2026Published Date November 09, 2026. Summary line: "Your Apple devices automatically block the compromised certificates in Safari, Mail, and apps that use Apple's frameworks."; "Some command-line tools included with macOS or the Xcode Command Line Tools (such as curl and git) require an extra step"; "Starting in macOS 27.2.1, these command-line tools stop accepting these certificates."; "macOS 26.7.3 and macOS 15.8.3 also include this protection."; under What Apple has done: "Starting in macOS 27.2.1, macOS also blocks these 12 certificates in the command-line tools included with macOS or the Xcode Command Line Tools" and it "also removes the two root CA certificates that the 12 certificates chain to from /etc/ssl/cert.pem, along with three other eMudhra root CA certificates"; "Some apps and tools include their own list of root CA certificates and don't use Apple's block or /etc/ssl/cert.pem", contact the developer; under If you can't update your Mac: the tools "(including curl, git, python3, ruby, perl, and openssl) check certificates against /etc/ssl/cert.pem"; the four commands, the fourth being openssl crl2pkcs7 -nocrl -certfile /etc/ssl/cert.pem | openssl pkcs7 -print_certs -noout | grep -E 'emSign ECC Root CA - G3|AAA Certificate Services', which "shows nothing" if both roots were removed; "After you update to macOS 27.2.1, macOS 26.7.3, or macOS 15.8.3, you don't need to repeat these steps"; delete the backup with sudo rm /etc/ssl/cert.pem.orig "and don't restore a backup that you made before the update"; the table Root CA certificates removed from /etc/ssl/cert.pem: emSign ECC Root CA - G3, AAA Certificate Services, emSign Root CA - G1, emSign Root CA - C1, emSign ECC Root CA - C3, with the warning that tools using only this file "might not be able to verify some websites" whose certificates chain to these roots through unaffected intermediates. The page carries no date but the Published Date. Accessed November 10, 2026.
  2. Apple Support, “What's new in the updates for macOS 27 Golden Gate - Apple Support” accessed Nov 10, 2026Published Date November 09, 2026; the newest section, macOS 27.2.1, reads in full "This update provides bug fixes and security updates for your Mac." Accessed November 10, 2026.
  3. Apple Support, “About the security content of macOS Golden Gate 27.2.1 - Apple Support” accessed Nov 10, 2026"Released November 9, 2026"; eight entries: AirPlay, "An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts", CVE-2026-113968: Apple; Bluetooth, "An attacker in Bluetooth range may be able to corrupt process memory", a use-after-free, CVE-2026-113970: Apple; brotli, "Processing maliciously crafted input may lead to memory corruption", an out-of-bounds write, CVE-2026-111497 with no credit; CoreUtils, "A malicious Bluetooth device may be able to establish a pairing without user interaction", CVE-2026-113965: Apple; CoreUtils, "An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction", CVE-2026-113964: an anonymous researcher; Messages, "A user added to an iMessage group may be able to access messages sent before they joined", CVE-2026-113960: an anonymous researcher; Messages, "A remote attacker may be able to join an iMessage group chat and receive its messages", CVE-2026-113961: an anonymous researcher; rapportd, "An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts", CVE-2026-113969: Apple. No entry says the issue may have been exploited. Accessed November 10, 2026.
  4. Apple Support, “About the security content of macOS Tahoe 26.7.3 - Apple Support” accessed Nov 10, 2026"Released November 9, 2026"; the same eight entries as the macOS Golden Gate 27.2.1 page, with the same Impact and Description text, CVE numbers and credits, each "Available for: macOS Tahoe". Accessed November 10, 2026.
  5. Apple Support, “About the security content of macOS Sequoia 15.8.3 - Apple Support” accessed Nov 10, 2026"Released November 9, 2026"; the same eight entries as the macOS Golden Gate 27.2.1 page, with the same Impact and Description text, CVE numbers and credits, each "Available for: macOS Sequoia". Accessed November 10, 2026.
  6. Apple Support, “Apple security releases - Apple Support” accessed Nov 10, 2026"The latest version of macOS is 27.2.1." Rows dated 09 Nov 2026 include macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3 and macOS Sequoia 15.8.3 (nine rows in all, the others iOS 27.2.1 and iPadOS 27.2.1, iOS 26.7.3 and iPadOS 26.7.3, iOS 18.7.12 and iPadOS 18.7.12, watchOS 27.2.1, watchOS 26.6.1, visionOS 27.2.1). No Safari row is dated 09 Nov 2026; the newest Safari row is Safari 27.2, macOS Sequoia and macOS Tahoe, 26 Oct 2026. Accessed November 10, 2026.
  7. MacRumors, “macOS 27.2.1 Fixes eMudhra Certificate Flaw in Command-Line Tools - MacRumors” accessed Nov 10, 2026Juli Clover, Monday November 9, 2026, 12:26 pm PST: "Apple also fixed the issue in the macOS Golden Gate 27.3 beta, but with the fix also included in macOS 27.2.1, users won't need to wait until December for protection." Accessed November 10, 2026.
  8. The Eclectic Light Company, “Apple has just released updates to macOS 27.2.1, 26.7.3 and 15.8.3 – The Eclectic Light Company” accessed Nov 10, 2026Howard Oakley (hoakley), November 9, 2026: "The 27.2.1 update is around 3.33 GB in size."; "The macOS 27.2.1 build number is 26B131, Safari's new version number is 27.2 (22625.2.8.11.9), and there is no update to mBoot firmware for Apple silicon Macs." Accessed November 10, 2026.
  9. Mr. Macintosh, “macOS Golden Gate 27.2.1 Update! Everything you need to know.” accessed Nov 10, 2026Posted November 9, 2026: "Golden Gate 27.2.1 (26B131)", "Golden Gate 27.2.1 (26B7131) – For M6 MacBook Pro & iMac", "Golden Gate 27.2.1 (26B8132) – For MacBook Pro PROLED XDR"; "Tahoe 26.7.3 (25G342)"; "Sequoia 15.8.3 (24H241)". Accessed November 10, 2026.
  10. 9to5Mac, “Today's macOS updates fix security gap involving eMudhra certificates - 9to5Mac” accessed Nov 10, 2026Marcus Mendes, November 9, 2026, 2:17 pm PT: "In response to the compromise, Apple began automatically blocking the affected certificates on October 19, followed by additional protections on October 23."; at the time Apple published a support article with manual instructions for administrators "while promising a fix in a future macOS update"; "Today, Apple updated the document to confirm that the fix is now available." The item takes the October 19 and October 23 dates and the fact that the November 9 document is an update of the October one. Accessed November 10, 2026.

Then and now

All pairings

On November 10, 2005, Bill Fox told you to check your Flash Player plug-in's version and install 8.0.22 for security; in 2026 the check is one openssl command and the fix is macOS 27.2.1.

More on eMudhra certificate compromise

Also on November 10, other years

Every November 10 since 1997

Saw something? Send a tip or a correction

The archive ran on reader tips. What did you see, where, and do you want the credit? Something wrong on this page? Say so and it gets fixed.

Read by the editor. You get a copy by email. Never published without your say.

More in Mac OS · This month in the archive