eMudhra Intermediate CA Compromise
· Source: Simon Willison
Private keys for eight intermediate certificates issued by eMudhra have been compromised. These certificates are part of the trust chain that underpins the root programs of Mozilla, Microsoft, Apple, and Chrome, as well as many other trusted stores used by various applications. The breach means that any software relying on a static list of trusted certificates must update to remove the vulnerable certificates and prevent potential impersonation attacks.
Operating‑system maintainers and development environments are already releasing fixes. Linux distributions should update the ca‑certificates package, while the Python ecosystem has issued new releases of uv (0.13.4), pip (26.2.2), and certifi (2026.10.19) that include revised certificate lists. These updates are essential to ensure HTTPS connections continue to be verified securely.
This news is significant because trust in public‑key infrastructure is the foundation of internet security. A compromised certificate can enable an attacker to intercept or forge encrypted communications, affecting millions of users and services that depend on TLS authentication. Keeping certificate stores current is therefore a critical measure for preserving the integrity and confidentiality of online information.
Read the original article on Simon Willison
This summary is an informational synthesis produced by dataqbs.com. All rights to the original content belong to its author and the cited media outlet. We act solely as curators of technology news and claim no authorship.