{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:58:23.236Z",
  "tag": {
    "id": "certifi",
    "label": "Certifi",
    "isStack": false,
    "url": "https://pwn.watch/t/certifi",
    "feed": "https://pwn.watch/t/certifi/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 1,
    "notFullyPatched": 1,
    "patched": 0
  },
  "incidents": [
    {
      "slug": "emudhra-intermediate-ca-compromise",
      "title": "eMudhra intermediate CA private keys compromised",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise",
      "json": "https://pwn.watch/i/emudhra-intermediate-ca-compromise.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "partial",
      "product": "eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA stores",
      "tags": [
        "python",
        "pypi",
        "go",
        "node",
        "java",
        "rust",
        "emudhra",
        "tls",
        "certifi",
        "pip",
        "uv"
      ],
      "cveIds": [
        "CVE-2026-111943",
        "CVE-2026-91403"
      ],
      "affectedVersions": [
        "Clients trusting eMudhra ECC intermediates before Oct 17–21 2026 browser/OS/runtime blocks; Go before 1.27.3 / 1.26.10; Electron before 44.9.1 / 43.8.1 / 42.11.16; Node.js before the Oct 21 security releases; Python certifi 2019.3.9 to before 2026.10.19 (GHSA-6q48-6c7w-9gw2), pip before 26.2.2 (vendored certifi), uv before 0.13.4"
      ],
      "fixedVersions": [
        "Electron 44.9.1 / 43.8.1 / 42.11.16",
        "Go 1.27.3 / 1.26.10",
        "Node.js 22.23.4 / 24.22.1 / 26.12.1",
        "Python certifi 2026.10.19",
        "NSS 3.131.1",
        "Java 27.0.1.0.2 / 25.0.5.0.2 / 21.0.13.0.2 / 17.0.21.0.2 / 11.0.33.0.2 / 8u511+ (CVE-2026-91403)",
        "Deno 2.9.8",
        "rustls-webpki 0.103.16 / webpki-roots 1.0.10",
        "pip 26.2.2 / uv 0.13.4 / sigstore 4.5.1 / conda 26.9.4 / pixi 0.82.1 (Python ecosystem)",
        "Ubuntu/Debian/Alpine/Fedora/Arch ca-certificates updates (see tracker)",
        "Docker Desktop 4.96.2",
        "mitmproxy 12.3.0"
      ],
      "startedAt": "2026-10-18",
      "closedAt": null,
      "updatedAt": "2026-10-22T21:57:21+02:00",
      "summary": "Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Laurent",
      "handle": "L4UR3N7",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2016030962463707137/Sxwti3lj_bigger.jpg",
      "text": "🚨🚨🚨 ALERTE SÉCURITÉ MAXIMALE ! Python est compromis.\n\n🔸 Mettez immédiatement pip à la version 26.2.2 ou plus.\n🔸 Dans chaque projet Python (chaque venv) : python -m pip install --upgrade pip\n🔸 uv : uv self update (0.13.4 ou plus)\n🔸 Mettez aussi à jour les certificats du",
      "date": "2026-10-22T15:27:57.000Z",
      "url": "https://x.com/L4UR3N7/status/2113291274664976774",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "IOActive, Inc",
      "handle": "IOActive",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1039931315766870016/ahOvevDU_bigger.jpg",
      "text": "8 eMudhra intermediate TLS certs had private keys of just 3 to 8 bits. Anyone could have used them to mint trusted certs for any site.\n\nBrowsers have blocked them. Linux distros, containers, IoT, and embedded devices are another story. https://t.co/yCsyEJsqnO",
      "date": "2026-10-22T14:55:15.000Z",
      "url": "https://x.com/IOActive/status/2113283045671502288",
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Appwrite",
      "handle": "appwrite",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2039591646095093760/w0wOnRMo_bigger.jpg",
      "text": "An update on PHP2Shell and the eMudhra certificate compromise.\n\nWe've confirmed that Appwrite is not affected by PHP2Shell. Appwrite Cloud is also patched for eMudhra in every region.\n \nHere's what we've checked and what self-hosted users should do. 🧵",
      "date": "2026-10-22T12:46:16.000Z",
      "url": "https://x.com/appwrite/status/2113250583998316980",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Moneycontrol",
      "handle": "moneycontrolcom",
      "avatarUrl": "https://pbs.twimg.com/profile_images/841519699632447488/ea4043nJ_bigger.jpg",
      "text": "#TechWithMC | eMudhra to exit global website security certificate business after key-generation flaw\n\nIts Indian digital signature and eSign services will continue to operate as usual\n\nRead More:\nhttps://t.co/AFxrCdzSlz",
      "date": "2026-10-22T11:55:49.000Z",
      "url": "https://x.com/moneycontrolcom/status/2113237890239214043",
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Internet Freedom Foundation (IFF)",
      "handle": "internetfreedom",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1255541950070964225/6WdosHR2_bigger.jpg",
      "text": "A Certifying Authority used the number “4” as a private key.\n\neMudhra’s weak keys could let fraudsters fake your bank’s website, padlock included. We’ve written to eMudhra, the Controller of Certifying Authorities and CERT-In asking for a fix.\n\n#eMudhra #Cybersecurity https://t.co/VTxAGHqi6L",
      "date": "2026-10-22T11:42:57.000Z",
      "url": "https://x.com/internetfreedom/status/2113234649258615256",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "ET NOW",
      "handle": "ETNOWlive",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1863866767027933184/hC9WqRl-_bigger.jpg",
      "text": "#NewsAlert | MeitY says: Impact of eMudhra incident on Indian websites, apps was limited\n\nEngages stakeholders to resolve eMudhra incident; here are the other key statements👇\n\n@GoI_MeitY https://t.co/qeeVfhni77",
      "date": "2026-10-21T14:32:04.000Z",
      "url": "https://x.com/ETNOWlive/status/2112914822019137966",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Dark Web Intelligence",
      "handle": "DailyDarkWeb",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1507666522008915969/T-CQnTJy_bigger.jpg",
      "text": "⚠️ UPDATE: eMUDHRA INTERMEDIATE CA PRIVATE KEYS PROVEN COMPROMISED, NOT JUST WEAK\n\nA new disclosure site for the eMudhra (emSign) incident confirms that the private keys of all eight affected intermediate CAs are compromised. To prove it, the original reporter signed a message https://t.co/dh7UYyF5JC",
      "date": "2026-10-20T23:14:17.000Z",
      "url": "https://x.com/DailyDarkWeb/status/2112683854356152830",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVHCw9TbUAEtlZa.jpg"
        }
      ],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "flow in 🏴‍☠️",
      "handle": "flowirin",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1779389632750428160/DA8czVom_bigger.jpg",
      "text": "The private keys of eight eMudhra intermediate CA certificates have been compromised. \n\nThey chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.\n\n eMudhra (Emudhra Limited) is an Indian company.⁠\n\nIt is",
      "date": "2026-10-20T20:31:12.000Z",
      "url": "https://x.com/flowirin/status/2112642813259301083",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Dark Web Intelligence",
      "handle": "DailyDarkWeb",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1507666522008915969/T-CQnTJy_bigger.jpg",
      "text": "🚨 WEAK eMUDHRA CA KEYS TRIGGER EMERGENCY TRUST UPDATES ACROSS BROWSERS, GO AND PYTHON\n\nThe private keys of eight eMudhra (emSign) intermediate CA certificates were generated so badly that anyone can recover them. A researcher reported it to the Chrome, Mozilla, Apple and https://t.co/NU2jaFYmzr",
      "date": "2026-10-20T19:14:12.000Z",
      "url": "https://x.com/DailyDarkWeb/status/2112623438049497364",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVGL0TgbgAAMXNS.jpg"
        }
      ],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "CloudDog",
      "handle": "CloudDogx",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2106561242634825728/kAz3w_Hc_bigger.jpg",
      "text": "8 intermediate CA private keys from eMudhra have been compromised. Reported to Mozilla on Oct 17, browsers started emergency-blocking the certs within hours; Apple and Microsoft followed on the 19th and 20th. Go, Electron, Python certifi, Rust and NSS all pushed fixes. Update",
      "date": "2026-10-20T18:35:18.000Z",
      "url": "https://x.com/CloudDogx/status/2112613648388739471",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Charlie Marsh",
      "handle": "charliermarsh",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1490182599981125634/ex0Jezvf_bigger.jpg",
      "text": "We just released uv 0.13.4, which updates our bundled certs in response to the eMudra incident.\n\nThis is a huge deal, and not unique to uv! It affects much of open source due to bundled CAs in certifi, webpki-root-certs, etc. Please upgrade anything that bundles CA certs.",
      "date": "2026-10-20T17:36:56.000Z",
      "url": "https://x.com/charliermarsh/status/2112598956996010030",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Xavier Rivera",
      "handle": "XavierRiveraX",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2102132195200479232/2hHv0Px0_bigger.jpg",
      "text": "Eight eMudhra intermediate CA private keys are compromised. They chain to roots trusted by Mozilla, Microsoft, Apple and Chrome, so whoever holds them could impersonate any site.\n\nFirefox, Chrome, Apple and Microsoft already block them. Apps that carry their own CA bundle don't",
      "date": "2026-10-20T14:44:43.000Z",
      "url": "https://x.com/XavierRiveraX/status/2112555618019971544",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    }
  ],
  "changes": [
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Tracker lists patched releases across distros, language runtimes and tools; Bun, Erlang certifi and Bottlerocket still pending. mitmproxy 12.3.0 drops eMudhra CAs.",
      "body": null,
      "sourceUrl": "https://emudhra.we-have-a-problem.com/",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "eMudhra says a flaw in its April 30 2025 key generation ceremony produced a second set of weak keys, and those were the ones published to root stores; root cause still under investigation, replacement certs being issued to customers.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/22/certification-authority-emudhra-defends-its-laughably-weak-private-keys/5304647",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Internet Freedom Foundation says it has written to eMudhra, India’s Controller of Certifying Authorities and CERT-In asking for a fix.",
      "body": null,
      "sourceUrl": "https://x.com/internetfreedom/status/2113234649258615256",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "eMudhra's board decides to exit the global SSL/TLS certificate business (about 1% of revenue); existing certificates stay supported until expiry or replacement, revocation and status services stay up, and its Indian DSC and eSign businesses continue.",
      "body": null,
      "sourceUrl": "https://www.moneycontrol.com/technology/emudhra-to-exit-global-website-security-certificate-business-after-key-generation-flaw-article-14057821.html",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Co-founder Kaushik Srinivasan blames human error and a script failure in the Apr 30 2025 key ceremony (no maker-checker controls), says the eight issuers never issued end-entity certificates and there was no breach; one US customer has about 30,000 certificates on the distrusted ECC chain, while its RSA chain stays trusted.",
      "body": null,
      "sourceUrl": "https://www.tribuneindia.com/news/business/emudhra-attributes-certificate-security-incident-to-human-error-co-founder-says-few-customers-directly-affected/",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Lightning Labs ships Go 1.27.3 rebuilds (including lnd v0.21.5-beta.rc1) to address CVE-2026-111943; CTO Olaoluwa Osuntokun tells lnd, btcd, tapd and litd users to install the new binaries or rebuild with Go 1.27.3, since updating Go or the OS alone does not fix already-built binaries.",
      "body": null,
      "sourceUrl": "https://github.com/lightningnetwork/lnd/releases",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "eMudhra published statements; Node.js security release refreshed CA store.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "Oracle and OpenJDK publish CVE-2026-91403 (CVSS 9.1, JSSE): Java updates distrust the eight intermediates; blocked.certs / revocation-check workaround provided.",
      "body": null,
      "sourceUrl": "https://openjdk.org/groups/vulnerability/advisories/2026-10-21",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "India's MeitY forms a special team to probe the incident; says impact on Indian websites and apps was limited.",
      "body": null,
      "sourceUrl": "https://x.com/ETNOWlive/status/2112914822019137966",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "Python ships expedited security releases 3.15.1, 3.14.9 and a special 3.13.17 that bundle pip 26.2.2 (certifi 2026.10.19) to drop the compromised eMudhra chain; existing venvs still need pip and uv upgraded by hand.",
      "body": null,
      "sourceUrl": "https://blog.python.org/2026/10/python-3151-3149-31317/",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-20",
      "title": "Community tracker emudhra.we-have-a-problem.com listed patched software; Alpine/curl/certifi/Go/Electron updates rolled.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-20",
      "title": "Python: certifi 2026.10.18 drops all emSign roots (GHSA-6q48-6c7w-9gw2, CVSS 7.4); 2026.10.19 restores the unaffected ones. pip 26.2.2 vendors the new certifi and uv 0.13.4 refreshes its bundled Mozilla roots (GHSA-hq85-5cpj-mr62).",
      "body": null,
      "sourceUrl": "https://advisories.gitlab.com/pypi/certifi/GHSA-6q48-6c7w-9gw2/",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-20",
      "title": "Python Software Foundation's Seth Larson tells Python users to upgrade certifi 2026.10.19, pip 26.2.2, uv 0.13.4, sigstore 4.5.1, conda 26.9.4 and pixi 0.82.1 in every venv and rebuild container images. pip below 26.2.2 keeps trusting the bad CAs through its vendored certifi even if the OS store is fixed, so pip itself has to be upgraded.",
      "body": null,
      "sourceUrl": "https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-19",
      "title": "eMudhra revoked the eight intermediates; browsers continued emergency distrust.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-18",
      "title": "Independent researcher reported weak/compromisable eMudhra intermediate keys to Apple, Google, Microsoft and Mozilla.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    }
  ]
}