Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Supply chainFull incident
LiveCriticalPartly patchedSupply chain

Day · Oct 23, 2026

eMudhra intermediate CA private keys compromised

eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA stores

Follow this incident

Updates on Oct 23, 2026

  1. Oracle's GraalVM team publishes a Native Image advisory: native executables capture the JDK trust store and certificate blocklist at build time, so updating the JDK does not fix existing binaries. Remove the emSign ECC Root CA - G3 and AAA Certificate Services roots from the build trust store and rebuild, or start the executable with a replacement PKCS12 trust store.

Summary

Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.

Read the full incident →

Advisories13

Sponsored

Buy sponsor slot · $149/mo