Apple’s macOS Golden Gate 27.2.1 update closes a security gap involving compromised eMudhra certificates. Apple had blocked the certificates in Safari, Mail, and apps using Apple frameworks in October, but command-line programs such as curl and git could still trust them. The new update prevents those tools from accepting the affected certificates, extending protection to developers and others who rely on command-line software. Apple also released macOS 26.7.3 and macOS 15.8.3 for users on older operating-system versions.
Mozilla’s investigation found that the certificates were issued with private key values below 256, making the keys easy to recover. An attacker could use them to create fraudulent certificates that appeared valid for any website, potentially enabling deceptive or intercepted connections. Before the update, Apple’s recommended workaround was to manually remove the affected root certificates from the Mac’s /etc/ssl/cert.pem file; those instructions remain available for systems that cannot be updated. The fix also appeared in the macOS 27.3 beta, but its inclusion in 27.2.1 means users can get protection without waiting for that later release.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Penlink’s Webloc, which uses advertising data for surveillance, has been purchased by security agencies across multiple countries. Citizen Lab warns the system enables intrusive mass surveillance, with particular risks in authoritarian states. (citizenlab.ca)
Nvidia chips reportedly reached China in large quantities after Commerce Secretary Howard Lutnick declined to enforce export controls and failed to replace them. Lutnick should resign, the author argues, over the resulting national security risks. (nytimes.com)
DOC-foundry uses AI agents to create Sigma security detection rules, then has a simulated attacker test them. A deterministic referee checks coverage before a stakeholder review chain approves the rule and records its review trail. (github.com)
The FBI warns that the FaceStealer scheme targets cryptocurrency holders and steals their funds. Treat unsolicited offers and links with caution, and verify crypto services before sharing information or sending money. (fbi.gov)
Cloudflare’s abuse-reporting page is reportedly blank, leaving visitors unable to use the form it directs them to. The page is intended for reporting abuse hosted through Cloudflare. (news.ycombinator.com)
Home Assistant stores refresh-token secrets and signing keys in plaintext, while some tokens never expire and survive password changes. Anyone who obtains the configuration directory or a backup can retain access to the home, and restoring a backup can revive old tokens. (seclists.org)
Today's best Hacker News stories, summarized and screenshotted, one email a day.