Apple has released macOS Golden Gate 27.2.1, Tahoe 26.7.3, and Sequoia 15.8.3, with a security change that extends protection against compromised website certificates to Mac command-line tools. Apple’s security releases list dates all three updates to 9 November. The releases give users on three macOS generations an update to install, rather than making the newest operating system the only route to this protection.
The practical reason to update goes beyond a routine version-number bump. In a separate advisory about compromised eMudhra certificates, Apple explains that some command-line tools check a certificate file rather than its existing block list. These macOS releases close that gap for the affected certificates, including in tools developers use to download files and work with code.
What the security change fixes
According to Apple, attackers compromised the private keys of eight intermediate certificate authorities operated by eMudhra. Six issue TLS certificates, which help establish trust in website connections; someone holding those keys could create certificates that appear valid for any website. The other two issue code-signing certificates that Apple’s frameworks don’t trust. Both eMudhra and Sectigo have revoked the affected certificates.
Apple already blocks the 12 certificates associated with the six TLS authorities, plus a related root certificate, in Safari, Mail, and apps that use its networking and security frameworks. That block arrives through automatic certificate configuration updates, so users don’t need a full software update to receive it. However, some tools included with macOS or the Xcode Command Line Tools use `/etc/ssl/cert.pem` and don’t consult that block or check whether a certificate has been revoked.
Golden Gate 27.2.1, Tahoe 26.7.3, and Sequoia 15.8.3 extend the block to those command-line tools. They also remove five root certificates from the certificate file. Apple names curl, git, python3, ruby, perl, and openssl among the tools that can use it, making this a relevant update for people who work in Terminal as well as those who browse in Safari.
Which macOS update should you look for?
9to5Mac reports that the standard Golden Gate release carries build 26B131, while Tahoe and Sequoia carry 25G342 and 24H241 respectively. The report also lists a separate Golden Gate build, 26B8132, for the MacBook Pro with a PROLED XDR display. Those numbers identify different releases; users should let Software Update select the compatible software for their Mac.
The updates address a different part of the Mac software stack from Apple’s newly introduced AI usage packs for Logic Pro. Here, the immediate job is maintaining the operating system’s certificate protections. We recommend installing the compatible update rather than manually editing the certificate file if your Mac can receive it.
There is one practical consequence for developers and administrators to watch. Apple warns that tools relying only on the modified certificate file might stop verifying some websites whose certificates chain to the removed roots, even through unaffected intermediate authorities. Apps with their own root-certificate lists may need separate attention from their developers.
How do I install the update?
Back up your Mac, then open System Settings > General > Software Update. Follow Apple’s installation instructions, enter your administrator password when asked, and let installation finish without closing the lid or putting the Mac to sleep.
Why doesn’t my Mac show the same update as someone else’s?
Software Update offers only software compatible with your Mac model. If it says your Mac is up to date, you can check again with Command-R or by closing and reopening Software Update.
What if I can’t update my Mac?
Apple provides a manual certificate-removal procedure in its advisory for people who use the affected command-line tools. It requires administrator access and can affect website verification, so follow the official procedure carefully rather than deleting certificates indiscriminately.
