Summary of Notable Changes in iOS App Development (2026/10/28): eMudhra Certificate Authority Compromise, iOS 27.2 Release, and More
This page has been translated by machine translation. View original
When developing iOS apps, it's necessary to keep an eye not only on Apple's beta releases but also on specification changes in the SDKs and tools being used, from a maintenance perspective. This time, several developments overlapped—including the eMudhra certificate authority compromise, the official release of iOS 27.2, and the launch of iPhone Duo—so I decided to summarize the topics that caught my attention.
eMudhra Certificate Authority Compromise
On October 19, 2026, Google became aware that the private keys of multiple intermediate CA certificates issued by the certificate authority eMudhra had been compromised. If the root certificate linked to this intermediate CA remains trusted, an attacker could forge certificates that appear legitimate. If an attacker on the communication path launches a man-in-the-middle attack, there is a risk of interception and tampering with communications.
Affected SDKs embed a TLS root certificate bundle directly into the app binary. Even if the OS trust store is updated, this embedded bundle remains unchanged. Therefore, OS updates or server-side measures alone are not sufficient to fix the issue—the SDK must be updated, the app re-released, and users prompted to update.
Response on Apple Devices
Apple also published guidance on October 23, 2026. The private keys were leaked from eight intermediate CAs operated by eMudhra, six of which issue TLS certificates. Apple has been blocking 12 related certificates since October 19, and since October 23, has also been blocking the root certificate "emSign ECC Root CA - G3" on Apple devices.
- Apps using Safari, Mail, and Apple's networking and security frameworks are automatically covered by the block, and no action is required
/etc/ssl/cert.pem, which is referenced by curl, git, openssl, and other tools bundled with macOS and Xcode Command Line Tools, is scheduled to be addressed in a future software update. Most users are advised not to edit it manually, but if you frequently use curl or git and want to address it without waiting for the update, please refer to the manual removal instructions on the page- Apple's block does not apply to apps or tools that maintain their own certificate lists, so users are advised to check with the respective developers
The last item applies to Firebase SDK, Flutter, and Homebrew's ca-certificates, which are mentioned next.
Firebase SDK Update
Firebase has released a fix that removes the relevant root certificate from the SDK bundle. For native iOS apps, this affects apps using Cloud Firestore.
| Installation Method | Fixed Version |
|---|---|
| Swift Package Manager | 13.1.1 or later, or 12.19.3 |
| CocoaPods | 12.19.3 |
Since Firebase 12 is the last version available via CocoaPods, the fixed version for CocoaPods users is 12.19.3. Updates are needed for version 12.x prior to 12.19.3 and version 13.x prior to 13.1.0. If you're using CocoaPods, also check whether the Podfile is pinned to an older version.
You can check the version in use by looking at the FirebaseFirestore line in Package.resolved for Swift Package Manager, or Podfile.lock for CocoaPods.
Apps using Firestore with Unity, C++, or React Native are also affected, so please check the table on the page for the fixed versions if applicable.
Flutter Update
Flutter may require a core update regardless of whether Firebase is being used.
- Apps targeting Android, Windows, and Linux are affected even if Firestore is not used. Rebuild with Dart 3.13.7 or later and Flutter 3.47.8 or later
- For iOS and macOS apps using Firestore, update
cloud_firestoreto 7.1.0 (BoM 5.1.0 or later) or 6.10.1 (BoM 4.20.1)
Homebrew Update for Development Environment
On the development machine side, Mozilla removed eMudhra's root certificate "emSign ECC Root CA - G3" from its trust list on October 20, 2026. Homebrew's ca-certificates also excluded emSign's G3 root certificate with this PR. While this may not cause immediate issues, it's a good idea to update.
Homebrew's ca-certificates is the certificate bundle used by tools installed via Homebrew, such as openssl@3, wget, and ruby-build. It is separate from macOS's own trust store, and Apple's block does not apply here. You can check which installed packages use it with the following command:
brew uses --installed ca-certificates
If it appears in brew outdated, it needs updating, so proceed with the upgrade:
brew update
brew outdated ca-certificates
brew upgrade ca-certificates
After updating, verify that the version is 2026-10-20 or later:
brew list --versions ca-certificates
Also confirm that the relevant root certificate is no longer present in the certificate bundle. If the following command produces no output, you're good:
$(brew --prefix openssl@3)/bin/openssl crl2pkcs7 -nocrl -certfile "$(brew --prefix)/etc/ca-certificates/cert.pem" \
| $(brew --prefix openssl@3)/bin/openssl pkcs7 -print_certs -noout \
| grep -i "emSign.*G3"
Apple
iOS 27.2 Release
iOS & iPadOS 27.2 (24B119) was released on October 26, 2026. The release notes only had wording corrections from the RC; no items were added or removed.
The release notes mention the expanded App Tracking Transparency (ATT) prompt for the EU (required in France, Germany, Italy, Poland, and Romania), and a change in iOS 27.1 and later where the default layout margins for UIView become zero. It was unclear from the release notes whether the layout margins change applies only to apps built with the new SDK. Since it could affect users who upgrade to 27.2 on existing iPhones, it's worth testing your app on a device running 27.2. Note that at the time of writing, the official release of Xcode 27.2 is not yet available, so submitting with the 27.2 SDK requires using the RC.
Security Updates (iOS 27.2, iOS 26.7.2, iOS 18.7.11)
On the same day as iOS 27.2—October 26, 2026—security updates for various OS versions were also released.
| Update | Number of CVEs Fixed |
|---|---|
| iOS & iPadOS 27.2 | 163 |
| iOS & iPadOS 26.7.2 | 134 |
| iOS & iPadOS 18.7.11 | 3 |
In addition, macOS Golden Gate 27.2, Tahoe 26.7.2, Sequoia 15.8.2, tvOS 27.2, watchOS 27.2, visionOS 27.2, and Safari 27.2 were also released.
iOS 18.7.11 targets iPhone XS, XS Max, XR, and iPad (7th generation). It also includes a fix for the CoreGraphics vulnerability (CVE-2026-86950) that was patched in iOS 26.7.1, which was reportedly exploited in targeted attacks—the fix has now reached older devices that cannot upgrade to iOS 27.
iPhone Duo Launch
iPhone Duo launched on October 23, 2026. Apple's security releases list shows iOS 27.1 on the same date, with iPhone Duo listed as the only target.
The day before, on October 22, 2026, TestFlight 4.4.1 added support for iPhone Duo, making it possible to distribute and test beta builds on a physical Duo device. If you don't have the hardware on hand, you can still use the iPhone Duo simulator in Xcode 27.1 or later's Device Hub to verify layouts when opening, closing, or changing orientation.
Xcode 27.2 RC Release
Xcode 27.2 RC (27B48) and iOS & iPadOS 27.2 RC (24B115) were released on October 19, 2026. Starting the following day, apps built with the 27.2 RC SDK can be submitted to the App Store.
- An issue added to Known Issues in Beta 3—where tests using
.rotateDigitalCrownin XCTest UI Automation would fail—is now listed as fixed in the RC - An issue that was a Known Issue in Xcode 27.1—where apps using
CameraCaptureAccessoryon the iPhone Duo simulator could use both displays without a capture session—is also listed as fixed - Device Hub improvements include slow-motion animation, shake/drop/memory pressure simulation (simulator only), and the option to hide the device bezel
On the other hand, a Known Issue is listed where the macOS, watchOS, tvOS, and visionOS SDKs treat 27.1 as a valid deployment target. There are also reports that setting 27.1 or 27.2 as the deployment target in Mac Catalyst may prevent access to new APIs, and an issue where iOS 27.1-specific APIs cause compile errors in Mac Catalyst remains unresolved.
Subscription Multi-Seat Purchasing Has Begun
Starting October 22, 2026, organizations using Apple Business or Apple School Manager can purchase auto-renewable subscriptions in bulk for the number of seats they need. Purchased seats are assigned and managed by the organization using their existing device management tools.
This setting is available in App Store Connect and is enabled by default if you haven't changed it. However, subscriptions created before September 14, 2026, that either don't use StoreKit 2 or have Family Sharing enabled are disabled by default. If there are subscriptions you don't want to sell to organizations, open the relevant subscription under "Subscriptions" in your app, and check the setting via "Edit" under "Purchase Options." Group purchasing, which allows individuals to buy multiple seats and invite others, is also planned to be testable in Sandbox starting November 2026, with availability on the App Store expected this winter.
Apple Developer Program License Agreement Revision
The Apple Developer Program License Agreement was revised on October 13, 2026. The main changes are as follows:
- Terms for using the Live Assistance API and App Replacement Entitlement have been added
- Terms for providing iOS app widgets in Apple HomeView and iOS apps for CarPlay have been added
- Terms for offering subscriptions via group purchasing or volume purchasing have been added
- It has been clarified that Apple may report tax, sales, and contact information to tax authorities, and that customer tax information shared by Apple may not be used for purposes other than those required by law
You need to sign in to your Apple Developer account and agree to the new terms. Only Account Holders can agree, so if you're working in a team, please ask your Account Holder to do so. A Japanese translation is expected to be published within one month.
App Store Connect Updates
The App Store Connect release notes included the following updates:
| Date | Content |
|---|---|
| 10/22 | In the Korean App Store, the age ratings for two content descriptors—"Infrequent profanity and crude humor" and "Infrequent mature or suggestive themes"—changed from All Ages to 12+ |
| 10/22 | TestFlight 4.4.1 was released with support for iPhone Duo |
| 10/21 | Xcode Cloud moved to a standalone section within App Store Connect. It was also clarified that iOS, macOS, tvOS, and watchOS apps must be uploaded using Xcode 14 or later |
| 10/20 | Apps built with Xcode 27.2 RC (iOS 27.2 RC SDK) can now be uploaded to the App Store and TestFlight |
Summary
The most urgent item this time is the Firebase issue. Even if Apple blocks the certificate on the device side, it has no effect on SDKs with their own certificate bundles—a full app re-release is required. If your app uses Firestore, check the SDK version immediately. Apps built with Flutter for multi-platform deployment need to take note: even if Firestore isn't being used, the Android version and others may still be affected.
On top of app-side actions, updates to Homebrew and various OSes have also coincided. Attacks don't target apps alone—if the Mac used for building and signing, or devices used for testing, are compromised, the impact can be significant. Don't put off updating Homebrew packages, macOS, or iOS on test devices; make a point of updating proactively.
With iOS 27.2 released, the ATT expanded prompt and layout margins changes may now affect existing iPhones. However, Xcode 27.2 remains in RC, so if you need to release changes targeting the 27.2 SDK right away, you'll need to submit using the RC. Whether to wait for the official release is a judgment call based on how urgently changes are needed.
For apps offering subscriptions, note that multi-seat purchasing is enabled by default. While leaving it enabled when there's no intent to sell to organizations probably won't cause major problems, it's worth checking App Store Connect once to make sure no unintended sales channels have been added.
Since the landscape surrounding iOS app development changes quickly, I plan to write another article when the next batch of notable changes accumulates.
Job Listings: Classmethod is Hiring iOS Engineers
The Starbucks Digital Technology division is looking for engineers with iOS app development skills. We'd love to hear from people who want to join us and share information about new Xcode and iOS features together in the misc-ios channel!
We are also hiring iOS/Android engineers in other areas. Let's talk mobile app development together!