{ "version": "https://jsonfeed.org/version/1.1", "title": "eMudhra intermediate CA private keys compromised · updates", "home_page_url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise", "feed_url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise/feed.json", "description": "Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.", "language": "en", "_pwn": { "slug": "emudhra-intermediate-ca-compromise", "severity": "critical", "status": "live", "patchStatus": "partial", "rss": "https://pwn.watch/i/emudhra-intermediate-ca-compromise/feed.xml", "llms": "https://pwn.watch/i/emudhra-intermediate-ca-compromise/llms.txt", "json": "https://pwn.watch/i/emudhra-intermediate-ca-compromise.json" }, "items": [ { "id": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-23-2c1e6ee6", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-23-2c1e6ee6", "title": "eMudhra intermediate CA private keys compromised: Oracle's GraalVM team publishes a Native Image advisory: native executables capture the JDK trust store and certificate blocklist at build time, so updating the JDK does not fix existing binaries. Remove the emSign ECC Root CA - G3 and AAA Certificate Services roots from the build trust store and rebuild, or start the executable with a replacement PKCS12 trust store.", "content_text": "eMudhra intermediate CA private keys compromised: Oracle's GraalVM team publishes a Native Image advisory: native executables capture the JDK trust store and certificate blocklist at build time, so updating the JDK does not fix existing binaries. Remove the emSign ECC Root CA - G3 and AAA Certificate Services roots from the build trust store and rebuild, or start the executable with a replacement PKCS12 trust store.\n\nSource: https://www.graalvm.org/uploads/native-image-advisory-oct-2026-cspu.pdf", "date_published": "2026-10-23T00:00:00.000Z", "external_url": "https://www.graalvm.org/uploads/native-image-advisory-oct-2026-cspu.pdf", "tags": [ "critical" ] }, { "id": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-22-2b3fbfe3", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-22-2b3fbfe3", "title": "eMudhra intermediate CA private keys compromised: Tracker lists patched releases across distros, language runtimes and tools; Bun, Erlang certifi and Bottlerocket still pending. mitmproxy 12.3.0 drops eMudhra CAs.", "content_text": "eMudhra intermediate CA private keys compromised: Tracker lists patched releases across distros, language runtimes and tools; Bun, Erlang certifi and Bottlerocket still pending. mitmproxy 12.3.0 drops eMudhra CAs.\n\nSource: https://emudhra.we-have-a-problem.com/", "date_published": "2026-10-22T00:00:00.000Z", "external_url": "https://emudhra.we-have-a-problem.com/", "tags": [ "critical" ] }, { "id": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-22-cc1da756", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-22-cc1da756", "title": "eMudhra intermediate CA private keys compromised: eMudhra says a flaw in its April 30 2025 key generation ceremony produced a second set of weak keys, and those were the ones published to root stores; root cause still under investigation, replacement certs being issued to customers.", "content_text": "eMudhra intermediate CA private keys compromised: eMudhra says a flaw in its April 30 2025 key generation ceremony produced a second set of weak keys, and those were the ones published to root stores; root cause still under investigation, replacement certs being issued to customers.\n\nSource: https://www.theregister.com/security/2026/10/22/certification-authority-emudhra-defends-its-laughably-weak-private-keys/5304647", "date_published": "2026-10-22T00:00:00.000Z", "external_url": "https://www.theregister.com/security/2026/10/22/certification-authority-emudhra-defends-its-laughably-weak-private-keys/5304647", "tags": [ "critical" ] }, { "id": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-22-9291e5b1", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-22-9291e5b1", "title": "eMudhra intermediate CA private keys compromised: Internet Freedom Foundation says it has written to eMudhra, India’s Controller of Certifying Authorities and CERT-In asking for a fix.", "content_text": "eMudhra intermediate CA private keys compromised: Internet Freedom Foundation says it has written to eMudhra, India’s Controller of Certifying Authorities and CERT-In asking for a fix.\n\nSource: https://x.com/internetfreedom/status/2113234649258615256", "date_published": "2026-10-22T00:00:00.000Z", "external_url": "https://x.com/internetfreedom/status/2113234649258615256", "tags": [ "critical" ] }, { "id": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-22-61c94c7e", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-22-61c94c7e", "title": "eMudhra intermediate CA private keys compromised: eMudhra's board decides to exit the global SSL/TLS certificate business (about 1% of revenue); existing certificates stay supported until expiry or replacement, revocation and status services stay up, and its Indian DSC and eSign businesses continue.", "content_text": "eMudhra intermediate CA private keys compromised: eMudhra's board decides to exit the global SSL/TLS certificate business (about 1% of revenue); existing certificates stay supported until expiry or replacement, revocation and status services stay up, and its Indian DSC and eSign businesses continue.\n\nSource: https://www.moneycontrol.com/technology/emudhra-to-exit-global-website-security-certificate-business-after-key-generation-flaw-article-14057821.html", "date_published": "2026-10-22T00:00:00.000Z", "external_url": "https://www.moneycontrol.com/technology/emudhra-to-exit-global-website-security-certificate-business-after-key-generation-flaw-article-14057821.html", "tags": [ "critical" ] }, { "id": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-22-d7152b19", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-22-d7152b19", "title": "eMudhra intermediate CA private keys compromised: Co-founder Kaushik Srinivasan blames human error and a script failure in the Apr 30 2025 key ceremony (no maker-checker controls), says the eight issuers never issued end-entity certificates and there was no breach; one US customer has about 30,000 certificates on the distrusted ECC chain, while its RSA chain stays trusted.", "content_text": "eMudhra intermediate CA private keys compromised: Co-founder Kaushik Srinivasan blames human error and a script failure in the Apr 30 2025 key ceremony (no maker-checker controls), says the eight issuers never issued end-entity certificates and there was no breach; one US customer has about 30,000 certificates on the distrusted ECC chain, while its RSA chain stays trusted.\n\nSource: https://www.tribuneindia.com/news/business/emudhra-attributes-certificate-security-incident-to-human-error-co-founder-says-few-customers-directly-affected/", "date_published": "2026-10-22T00:00:00.000Z", "external_url": "https://www.tribuneindia.com/news/business/emudhra-attributes-certificate-security-incident-to-human-error-co-founder-says-few-customers-directly-affected/", "tags": [ "critical" ] }, { "id": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-22-ab1af7e1", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-22-ab1af7e1", "title": "eMudhra intermediate CA private keys compromised: Lightning Labs ships Go 1.27.3 rebuilds (including lnd v0.21.5-beta.rc1) to address CVE-2026-111943; CTO Olaoluwa Osuntokun tells lnd, btcd, tapd and litd users to install the new binaries or rebuild with Go 1.27.3, since updating Go or the OS alone does not fix already-built binaries.", "content_text": "eMudhra intermediate CA private keys compromised: Lightning Labs ships Go 1.27.3 rebuilds (including lnd v0.21.5-beta.rc1) to address CVE-2026-111943; CTO Olaoluwa Osuntokun tells lnd, btcd, tapd and litd users to install the new binaries or rebuild with Go 1.27.3, since updating Go or the OS alone does not fix already-built binaries.\n\nSource: https://github.com/lightningnetwork/lnd/releases", "date_published": "2026-10-22T00:00:00.000Z", "external_url": "https://github.com/lightningnetwork/lnd/releases", "tags": [ "critical" ] }, { "id": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-22-874e3fd7", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-22-874e3fd7", "title": "eMudhra intermediate CA private keys compromised: LibreSSL releases 4.2.3, 4.3.4 and 4.4.0 with a security fix that removes the eMudhra emSign ECC Root CA - G3 from cert.pem because of the weak subordinate CA keys; uncompromised intermediates were added for interoperability.", "content_text": "eMudhra intermediate CA private keys compromised: LibreSSL releases 4.2.3, 4.3.4 and 4.4.0 with a security fix that removes the eMudhra emSign ECC Root CA - G3 from cert.pem because of the weak subordinate CA keys; uncompromised intermediates were added for interoperability.\n\nSource: https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.3.4-relnotes.txt", "date_published": "2026-10-22T00:00:00.000Z", "external_url": "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.3.4-relnotes.txt", "tags": [ "critical" ] }, { "id": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-21-2c87563b", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-21-2c87563b", "title": "eMudhra intermediate CA private keys compromised: eMudhra published statements; Node.js security release refreshed CA store.", "content_text": "eMudhra intermediate CA private keys compromised: eMudhra published statements; Node.js security release refreshed CA store.", "date_published": "2026-10-21T00:00:00.000Z", "tags": [ "critical" ] }, { "id": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-21-4438182d", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-21-4438182d", "title": "eMudhra intermediate CA private keys compromised: Oracle and OpenJDK publish CVE-2026-91403 (CVSS 9.1, JSSE): Java updates distrust the eight intermediates; blocked.certs / revocation-check workaround provided.", "content_text": "eMudhra intermediate CA private keys compromised: Oracle and OpenJDK publish CVE-2026-91403 (CVSS 9.1, JSSE): Java updates distrust the eight intermediates; blocked.certs / revocation-check workaround provided.\n\nSource: https://openjdk.org/groups/vulnerability/advisories/2026-10-21", "date_published": "2026-10-21T00:00:00.000Z", "external_url": "https://openjdk.org/groups/vulnerability/advisories/2026-10-21", "tags": [ "critical" ] }, { "id": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-21-b6fef099", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-21-b6fef099", "title": "eMudhra intermediate CA private keys compromised: India's MeitY forms a special team to probe the incident; says impact on Indian websites and apps was limited.", "content_text": "eMudhra intermediate CA private keys compromised: India's MeitY forms a special team to probe the incident; says impact on Indian websites and apps was limited.\n\nSource: https://x.com/ETNOWlive/status/2112914822019137966", "date_published": "2026-10-21T00:00:00.000Z", "external_url": "https://x.com/ETNOWlive/status/2112914822019137966", "tags": [ "critical" ] }, { "id": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-21-548f61bc", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-21-548f61bc", "title": "eMudhra intermediate CA private keys compromised: Python ships expedited security releases 3.15.1, 3.14.9 and a special 3.13.17 that bundle pip 26.2.2 (certifi 2026.10.19) to drop the compromised eMudhra chain; existing venvs still need pip and uv upgraded by hand.", "content_text": "eMudhra intermediate CA private keys compromised: Python ships expedited security releases 3.15.1, 3.14.9 and a special 3.13.17 that bundle pip 26.2.2 (certifi 2026.10.19) to drop the compromised eMudhra chain; existing venvs still need pip and uv upgraded by hand.\n\nSource: https://blog.python.org/2026/10/python-3151-3149-31317/", "date_published": "2026-10-21T00:00:00.000Z", "external_url": "https://blog.python.org/2026/10/python-3151-3149-31317/", "tags": [ "critical" ] }, { "id": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-20-8f3f50d8", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-20-8f3f50d8", "title": "eMudhra intermediate CA private keys compromised: Community tracker emudhra.we-have-a-problem.com listed patched software; Alpine/curl/certifi/Go/Electron updates rolled.", "content_text": "eMudhra intermediate CA private keys compromised: Community tracker emudhra.we-have-a-problem.com listed patched software; Alpine/curl/certifi/Go/Electron updates rolled.", "date_published": "2026-10-20T00:00:00.000Z", "tags": [ "critical" ] }, { "id": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-20-1bfb8baa", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-20-1bfb8baa", "title": "eMudhra intermediate CA private keys compromised: Python: certifi 2026.10.18 drops all emSign roots (GHSA-6q48-6c7w-9gw2, CVSS 7.4); 2026.10.19 restores the unaffected ones. pip 26.2.2 vendors the new certifi and uv 0.13.4 refreshes its bundled Mozilla roots (GHSA-hq85-5cpj-mr62).", "content_text": "eMudhra intermediate CA private keys compromised: Python: certifi 2026.10.18 drops all emSign roots (GHSA-6q48-6c7w-9gw2, CVSS 7.4); 2026.10.19 restores the unaffected ones. pip 26.2.2 vendors the new certifi and uv 0.13.4 refreshes its bundled Mozilla roots (GHSA-hq85-5cpj-mr62).\n\nSource: https://advisories.gitlab.com/pypi/certifi/GHSA-6q48-6c7w-9gw2/", "date_published": "2026-10-20T00:00:00.000Z", "external_url": "https://advisories.gitlab.com/pypi/certifi/GHSA-6q48-6c7w-9gw2/", "tags": [ "critical" ] }, { "id": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-20-cfb7de5f", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-20-cfb7de5f", "title": "eMudhra intermediate CA private keys compromised: Python Software Foundation's Seth Larson tells Python users to upgrade certifi 2026.10.19, pip 26.2.2, uv 0.13.4, sigstore 4.5.1, conda 26.9.4 and pixi 0.82.1 in every venv and rebuild container images. pip below 26.2.2 keeps trusting the bad CAs through its vendored certifi even if the OS store is fixed, so pip itself has to be upgraded.", "content_text": "eMudhra intermediate CA private keys compromised: Python Software Foundation's Seth Larson tells Python users to upgrade certifi 2026.10.19, pip 26.2.2, uv 0.13.4, sigstore 4.5.1, conda 26.9.4 and pixi 0.82.1 in every venv and rebuild container images. pip below 26.2.2 keeps trusting the bad CAs through its vendored certifi even if the OS store is fixed, so pip itself has to be upgraded.\n\nSource: https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576", "date_published": "2026-10-20T00:00:00.000Z", "external_url": "https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576", "tags": [ "critical" ] }, { "id": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-19-2974453e", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-19-2974453e", "title": "eMudhra intermediate CA private keys compromised: eMudhra revoked the eight intermediates; browsers continued emergency distrust.", "content_text": "eMudhra intermediate CA private keys compromised: eMudhra revoked the eight intermediates; browsers continued emergency distrust.", "date_published": "2026-10-19T00:00:00.000Z", "tags": [ "critical" ] }, { "id": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-18-58f1b844", "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise#2026-10-18-58f1b844", "title": "eMudhra intermediate CA private keys compromised: Independent researcher reported weak/compromisable eMudhra intermediate keys to Apple, Google, Microsoft and Mozilla.", "content_text": "eMudhra intermediate CA private keys compromised: Independent researcher reported weak/compromisable eMudhra intermediate keys to Apple, Google, Microsoft and Mozilla.", "date_published": "2026-10-18T00:00:00.000Z", "tags": [ "critical" ] } ] }