There is news about a security breach that should be on our TOP Priority dear Tech People. TL;DR: A security breach occurred at eMudhra, resulting in the leak of their private certificate keys. The implications are massive, affecting virtually every aspect of computing: operating systems (Windows, Linux, macOS), browsers, applications, and websites. Anything protected by these SSL certificates is now potentially vulnerable to Man-in-the-Middle (MiTM) attacks, where internet connections can be intercepted.
Most applications, such as browsers like Chrome, Firefox, Safari, and Brave, have already been auto-patched, so no action is required on your part. Operating systems (Windows, Linux, macOS) have also released patches. For now, try visiting this website in all your browsers: https://emudhra.we-have-a-problem.com/ (created by a Mozilla developer). If all the indicators are green, your browsers are secure; if you see any red, force an update immediately!
This isn't meant to incite fear or fearmongering, just check X (formerly Twitter) if you don't believe me! Or simply do little visit to search engine! Beyond recent 0-day vulnerabilities and two critical CVEs in PHP, this eMudhra issue is not something to be taken lightly. Assume that nothing is currently secure; update all your apps! If possible, apply OS or security updates, force them if you have to! For the time being, avoid visiting "shady" websites, limit the use of Bluetooth on your devices until security updates are issued, and so on.
Furthermore, for macOS users, there is one specific, powerful piece of software that requires your attention. Even if you aren't a developer and have never used it, if it isn't patched, which can only be done via an official Apple security update, your Mac could be compromised, even if you aren't actively doing anything. That software is curl. It comes pre-installed on macOS, meaning only Apple can provide the necessary security patch. On macOS, curl is located at /usr/bin/curl. I tested it by using curl to connect to a website reporting on this security incident, and the result was "bad."
In other words, even if you aren’t doing anything, curl could potentially serve as a security vulnerability. The solution:
Manually removed both root certificates from /etc/ssl/cert.pem and kept a backup at /etc/ssl/cert.pem.bak. Apple has been blocking the intermediate certificates in the Keychain since October 19, 2026, so Safari, Chrome, and all other applications are protected.
Even if you’ve never opened the Terminal on macOS before, please open it just this once and run this command:
sudo cp /etc/ssl/cert.pem /etc/ssl/cert.pem.bak &&
awk '/^(###|===) /{skip=0}
/^=== .*\/CN=(AAA Certificate Services|emSign ECC Root CA - G3)$/{skip=1}
!skip' /etc/ssl/cert.pem.bak | sudo tee /etc/ssl/cert.pem > /dev/null
Enter your password when prompted! That’s it. Now just wait until Apple releases a security update. Once they do, you can simply remove the backup file by running one more command: sudo rm /etc/ssl/cert.pem.bak.
If you run a VPS (Linux) and use an AI Agents (such as Hermes Agent, Pi, OpenCode, Claude, Codex, etc.), instruct your AI Agents to take preventive measures immediately! Happy patching and updating, everyone. 🥺
