Eight eMudhra intermediate CA private keys compromised
Original title: eMudhra Intermediate CA Compromise
The intermediates chain to roots in major browser programs, so bundled trust stores need updates.
Private keys for eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores. Software that bundles trusted certificates needs updating, including Linux ca-certificates packages. uv 0.13.4, pip 26.2.2 and certifi 2026.10.19 ship upgraded certificate lists.
Unconfirmed: How the private keys were compromised is not described.
- Eight intermediate CA certificates are affected.
- Trust chains reach Mozilla, Microsoft, Apple and Chrome root programs.
- uv 0.13.4, pip 26.2.2 and certifi 2026.10.19 include updated lists.
- A GitHub repository is tracking software updates.
Impact: compromised intermediate CA private keys in widely trusted chains
- 1.Update software that bundles trusted certificate lists.
- 2.Update Linux ca-certificates packages.
- 3.Upgrade uv to 0.13.4, pip to 26.2.2, and certifi to 2026.10.19.
From the original article
eMudhra Intermediate CA Compromise This is very, very bad news: The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores. Any software that bundles a list of trusted certificates needs to be updated.
simonwillison.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.