Cloudflare Changelog
@CFchangelog
Sandboxes SDK 0.12.14 is live to patch the eMudhra certificate compromise. Update your `Dockerfile` to use the new image and redeploy. t.co/QBvp8tFeFy
Dart
Security incidents tagged Dart. Newest first.
1 Dart incident in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 1
- Patched
- 0
- Days without an incident
- 0
- Longest quiet run: 1 day (Oct 25–Oct 25)
- CriticalPartly patched
eMudhra intermediate CA private keys compromised
Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.
eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA storesSince Oct 18, 2026
Posts 16
- eMudhra intermediate CA private keys compromised
- eMudhra intermediate CA private keys compromised
Gergely Orosz@GergelyOroszCalling it now: Chrome and Mozilla will remove eMudhra as a G1 root, nulling them as a CA. On 20 Oct, eMudhra had 24 hours to give an explanation of what exactly happened with the mis-signed certificate. They did not; asked for more time; and now blame “investors/customers” 🤡 t.co/QcAqbC9Ghl
- eMudhra intermediate CA private keys compromised
Josh Long@starbuxmaneMudhra certificate compromise: GraalVM Native Image advisory TL;DR: native images don't use the jdk certificate chain so u need to patch and rebuild t.co/CvBArfWJ9y
- eMudhra intermediate CA private keys compromised
OpenBSD@openbsdErrata patches released to address the eMudhra certificate compromise: t.co/yjC1vsBaLQ (More details: t.co/OdBh8wgrgL)
- eMudhra intermediate CA private keys compromised
Laurent@L4UR3N7🚨🚨🚨 ALERTE SÉCURITÉ MAXIMALE ! Python est compromis. 🔸 Mettez immédiatement pip à la version 26.2.2 ou plus. 🔸 Dans chaque projet Python (chaque venv) : python -m pip install --upgrade pip 🔸 uv : uv self update (0.13.4 ou plus) 🔸 Mettez aussi à jour les certificats du
- eMudhra intermediate CA private keys compromised
IOActive, Inc@IOActive8 eMudhra intermediate TLS certs had private keys of just 3 to 8 bits. Anyone could have used them to mint trusted certs for any site. Browsers have blocked them. Linux distros, containers, IoT, and embedded devices are another story. t.co/yCsyEJsqnO
+10 more on the incident pages above.
