dev.to· Oct 29, 2026· by slabb

Your Mac's git cloned a fake github.com without a warning: Apple, eMudhra, act three

Apple was told about the compromised eMudhra certificates on Oct 17. On Oct 28, my Mac's git cloned a fake github.com signed with them, no warning. macOS 27.2 even undid the manual workaround. The three-legged lab: Apple git intercepted, brew git safe, the fix verified. Act three of the series.

🎯 Vulnerability: Remote Code Execution (RCE)

💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.

#security#git#macos#supplychain

Your Mac's git cloned a fake github.com without a warning: Apple, eMudhra, act three

More Writeups Like This

Invisible Unicode in a Rules File Made Copilot and Cursor Write a Backdoor. Find It

A maintained package can still ship malware. What a health check can and can't see.

One machine, ten coding agents: giving each one its own identity

Check if the LiteLLM 1.107.0 compromise hit you in 30 seconds