Apple's git still trusts the compromised eMudhra certificates emudhra.we-have-a-problem.com

Security researcher Dennis Jackson says Apple’s macOS developer tools, including git, curl and Python, still trust compromised eMudhra certificates despite Apple being notified on October 17. He says macOS 27.2, released October 26, also reversed a manual workaround, potentially allowing attackers to intercept HTTPS traffic; he urges Apple to remove the affected roots and advises developers to reapply the workaround after updates.