day · Oct 20, 2026
eMudhra intermediate CA private keys compromised
› eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA stores
Get an email when a new major security incident drops. No spam, unsubscribe any time.
Updates on Oct 20, 2026
Community tracker emudhra.we-have-a-problem.com listed patched software; Alpine/curl/certifi/Go/Electron updates rolled.
## summary
Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.
read the full incident →## advisories[5]
- eMudhra statement on certificate security incidenteMudhra · Oct 21, 2026
- Mozilla, Google, Apple block compromised eMudhra CA certificatesBleepingComputer · Oct 20, 2026
- OpenJDK Vulnerability Advisory: 2026/10/21 (CVE-2026-91403)OpenJDK · Oct 21, 2026
- Oracle Security Alert Advisory - CVE-2026-91403Oracle · Oct 21, 2026
- mitmproxy 12.3.0 release (removes eMudhra CAs)mitmproxy · Oct 22, 2026
