The compromised certificates chain to root certificates trusted by the Mozilla, Microsoft, Apple and Chrome root programs, as well as many downstream trust stores. Any software that bundles a list of trusted certificates must be updated to remove the compromised intermediates. A GitHub repository is tracking software updates from affected vendors. In the Python ecosystem, updates have already been released: uv 0.13.4, pip 26.2.2, and certifi 2026.10.19 all include upgraded certificate lists. Linux distributions are expected to update their ca-certificates packages.
Eight eMudhra intermediate CA certificates compromised, urgent updates needed
Private key leak affects trust chains used by major browsers and operating systems
By LineZotpaper
Published
Updated
Read Time1 min
Sources2 outlets
The private keys of eight intermediate certificate authority certificates issued by eMudhra have been compromised, forcing urgent updates across software ecosystems that rely on bundled trust stores.
§
Analysis
Why This Matters
- The compromise undermines the trust model that underpins HTTPS and code signing, potentially allowing attackers to issue fraudulent certificates.
- Users must update their software immediately to avoid trusting certificates signed by these intermediate CAs.
- The incident affects a wide range of systems, from browsers to operating systems to developer tools.
Background
Certificate authorities (CAs) are trusted entities that issue digital certificates used for secure communications. Intermediate CAs sit between root CAs and end-entity certificates; if their private keys are leaked, attackers can forge certificates. This is one of the most severe types of CA incidents. eMudhra is a CA that has been trusted by major root programs.
Key Perspectives
- Users and system administrators: Must apply updates to trust stores (ca-certificates, certifi, etc.) as soon as they are available from their OS or package manager.
- Software vendors and package maintainers: Need to ship updated certificate bundles promptly to protect their users.
- Browser and OS vendors: May need to issue emergency updates or consider distrusting the affected eMudhra roots if the compromise is widespread.
What to Watch
- The completeness of the GitHub tracking repository: whether all major platforms and distributors have issued updates.
- Any announcement from Mozilla, Microsoft, Apple or Chrome regarding distrust of eMudhra root certificates.
- Reports of actual exploit attempts using the compromised keys.
Sources
- Mozilla, Google, Apple block compromised eMudhra CA certificates · BleepingComputer
- eMudhra Intermediate CA Compromise · Simon Willison's Weblog
Checked
8 claims in this story checked against 1 source: 4 supported.
Show each claim
- SupportedThe private keys of eight eMudhra intermediate CA certificates have been compromised.Simon Willison's Weblog: “The private keys of eight eMudhra intermediate CA certificates have been compromised.”
- Partly supportedUrgent updates are needed across software ecosystems that rely on bundled trust stores.Simon Willison's Weblog: “Any software that bundles a list of trusted certificates needs to be updated.”
- Partly supportedThe private-key leak affects trust chains used by major browsers and operating systems.Simon Willison's Weblog: “They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.”
- SupportedThe compromised certificates chain to roots trusted by Mozilla, Microsoft, Apple and Chrome root programs, and by many downstream trust stores.Simon Willison's Weblog: “They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.”
- Partly supportedSoftware bundling trusted-certificate lists must be updated to remove the compromised intermediates.Simon Willison's Weblog: “Any software that bundles a list of trusted certificates needs to be updated.”
- SupportedA GitHub repository is tracking software updates.Simon Willison's Weblog: “This site is tracking software updates via this GitHub repository”
- Supporteduv 0.13.4, pip 26.2.2 and certifi 2026.10.19 have released upgraded certificate lists.Simon Willison's Weblog: “In Python world uv 0.13.4 and pip 26.2.2 and certifi 2026.10.19 have been released with upgraded certificate lists.”
- Partly supportedLinux distributions are expected to update their ca-certificates packages.Simon Willison's Weblog: “Linux distros need to update their ca-certificates packages.”