Consensys.eth
@Consensys
Following the eMudhra certificate authority incident, the Besu, Teku and Web3Signer teams have shared notes for operators. → Besu: t.co/6j5rLcLBbd → Teku: t.co/djHIQNiHaA → Web3Signer: t.co/EzUaF4SOyi t.co/GFRZ1PUFM4
Web3signer
Security incidents tagged Web3signer. Newest first.
1 Web3signer incident in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 1
- Patched
- 0
- Days without an incident
- 0
- Longest quiet run: 1 day (Oct 25–Oct 25)
- CriticalPartly patched
eMudhra intermediate CA private keys compromised
Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.
eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA storesSince Oct 18, 2026
Posts 18
- eMudhra intermediate CA private keys compromised
- eMudhra intermediate CA private keys compromised
CERT-In@IndianCERTCERT-In has published Advisory on its website. Multiple Vulnerabilities in Oracle Products t.co/UVCjvG7j9L Compromise of eMudhra Intermediate CA Certificates t.co/gixbWR83Vf
- eMudhra intermediate CA private keys compromised
Cloudflare Changelog@CFchangelogSandboxes SDK 0.12.14 is live to patch the eMudhra certificate compromise. Update your `Dockerfile` to use the new image and redeploy. t.co/QBvp8tFeFy
- eMudhra intermediate CA private keys compromised
Gergely Orosz@GergelyOroszCalling it now: Chrome and Mozilla will remove eMudhra as a G1 root, nulling them as a CA. On 20 Oct, eMudhra had 24 hours to give an explanation of what exactly happened with the mis-signed certificate. They did not; asked for more time; and now blame “investors/customers” 🤡 t.co/QcAqbC9Ghl
- eMudhra intermediate CA private keys compromised
Josh Long@starbuxmaneMudhra certificate compromise: GraalVM Native Image advisory TL;DR: native images don't use the jdk certificate chain so u need to patch and rebuild t.co/CvBArfWJ9y
- eMudhra intermediate CA private keys compromised
OpenBSD@openbsdErrata patches released to address the eMudhra certificate compromise: t.co/yjC1vsBaLQ (More details: t.co/OdBh8wgrgL)
+12 more on the incident pages above.
