Apple Blocks Certificates That Could Help Attackers Fake Websites

Thursday October 22, 2026 4:43 am PDT by Hartley Charlton

Apple has blocked compromised security certificates on its devices that could help attackers impersonate websites, BleepingComputer reports.

apple lock security bug vulnerability fix privacy
The certificates were issued by certificate authority eMudhra. According to Mozilla's investigation, their private keys were all numbers below 256, making them almost instantly recoverable. Attackers could use the affected website certificate keys to create fraudulent certificates that vulnerable software would trust.

Apple introduced the blocks on October 19, according to an advisory from Mozilla cryptography engineer Dennis Jackson. These protections stop software using Apple's system checks from trusting the compromised certificates.

Jackson says Safari and other major browsers had additional certificate checks that would have prevented attacks through this route. Whether attackers exploited other software remains unknown.

Apple has already distributed blocks for the compromised certificates. Mac users who use the affected command-line tools can find tests and mitigation instructions on Jackson's website.

Tag: Cybersecurity

Popular Stories

Here's What Apple's Apps Look Like on the iPhone Duo

Tuesday October 20, 2026 11:12 am PDT by Juli Clover

With just three days to go until the iPhone Duo is released, Apple is getting ready for the launch. Behind the scenes, the App Store now has screenshots of Apple's built-in apps running on the Duo. We've seen some apps in marketing materials, but images of the ones we haven't seen give us an idea of what it will be like using the iPhone Duo day to day. Many apps are shown in landscape...

• 116 comments

Apple Pulls Keynote, Pages and Numbers From App Store [Update: Back]

Thursday October 22, 2026 11:01 am PDT by Juli Clover

Apple has temporarily removed Keynote, Pages, and Numbers from the App Store, just after releasing an update that added iPhone Duo support and a new Intelligent Assistant. It is not clear if the apps were removed intentionally, or if it is a bug. Apple has not said when the apps will be reinstated, but if it was in error, they should return soon. Update: The Mac versions are back without...

• 64 comments

RIP, MacBook Ultra

Monday October 19, 2026 9:37 am PDT by Joe Rossignol

Apple today sent out invites for an experience in Los Angeles on Wednesday, October 28, and the "Pro and tell" tagline on the invitation likely means that the rumored MacBook models with touch-enabled OLED displays will stick with MacBook Pro branding instead of the once-rumored "MacBook Ultra" name. The long-rumored "iPhone Ultra" ended up being named iPhone Duo, so speculation that Apple...

• 165 comments

Top Rated Comments

vegetassj4

18 hours ago at 05:22 am

One of the numbers was 4, by the way.

Four. One less than five.

That was the number standing in the way of bad actors.

FOUR.

At least it wasn’t 3

Score: 12 Votes (Like | Disagree)

Entilzha

18 hours ago at 04:48 am

One of the numbers was 4, by the way.

Four. One less than five.

That was the number standing in the way of bad actors.

FOUR.

Score: 9 Votes (Like | Disagree)

ArtOfWarfare

16 hours ago at 07:41 am

Good on researchers. This is a wake-up call. This has been stated and obvious from the beginning of the AI "boom" 1. AI will become a commodity and 2. It will be about whomever can keep devices safe FROM AI.

Eh, this is a regular massive security blunder that didn't require AI - a brute force attack is trivial and the original Apple Watch could have run the script to reveal all these compromised certs in under a second.

It was massive carelessness/oversight on the part of everyone involved in the approval of these certs and getting them installed on every devices/OSs/browsers truststore.

I considered the possibility that a malicious actor did this on purpose... probably not. If someone could stick an arbitrary cert into a truststore on every device because they wanted to snoop on all traffic globally, they'd generate an actual cert that only they know, not pick one that is trivial for anyone to crack. Unless they were going the extra steps ahead and wanted plausible deniability... but still, who knows, there's over 100 trusted certs on every device... how would we know that none of them are secretly controlled by a government intelligence agency?

Score: 6 Votes (Like | Disagree)

svish

18 hours ago at 04:53 am

Disappointing to see such issues happening. Glad to see Apple taking quick action with this issue.

Score: 6 Votes (Like | Disagree)

Superhai

18 hours ago at 05:31 am

One article I read on this disaster said that curl as delivered by Apple uses its own certificate store rather than the system one; it suggested that a problem remains for curl even after Apple’s action. The fine article also lists python as an affected tool with its own fix, so I wonder whether it too needs to be fixed separately on Macs 🤷‍♂️🤦‍♂️

Yes, it does, but the fix is (from Dennis Jacksons webpage ('https://emudhra.we-have-a-problem.com')) to run this in the Terminal (of course only if you know what you are doing). This is for curl, git, python, ruby, perl, you should check the page for pip, or reinstall it.

sudo cp -p /etc/ssl/cert.pem /etc/ssl/cert.pem.bak &&
sudo awk '/^(###|===) /{skip=0}
/^=== .*\/CN=(AAA Certificate Services|emSign ECC Root CA - G3)$/{skip=1}
!skip' /etc/ssl/cert.pem.bak | sudo tee /etc/ssl/cert.pem > /dev/null

Score: 5 Votes (Like | Disagree)

fredfnord

11 hours ago at 12:22 pm

One of the numbers was 4, by the way.

Four. One less than five.

That was the number standing in the way of bad actors.

FOUR.

It is important to note that these certificates require a number between 0 and 2 raised to the 256th power. That is roughly 1 followed by 80 zeros. Pick a number.

Normally one would have a random number generator pick one for you, but it certainly is possible to just mash your numeric keypad until you have 80 digits.

What you SHOULDN’T do is have the first 79 of those digits be “0”.

Score: 2 Votes (Like | Disagree)

Read All Comments

Apple Blocks Certificates That Could Help Attackers Fake Websites

Popular Stories

Here's What Apple's Apps Look Like on the iPhone Duo

Apple Pulls Keynote, Pages and Numbers From App Store [Update: Back]

RIP, MacBook Ultra

Top Rated Comments

Next Article

Videos

Guides

Upcoming

Other Stories