eMudhra CA Compromise Requires Urgent Updates
Eight intermediate CA certificates from eMudhra have been compromised, exposing their private keys. These intermediates chain to roots trusted across Mozilla, Microsoft, Apple, Chrome, and many downstream trust stores—a cascading failure with global reach.
The incident requires immediate updates wherever certificate lists are bundled. Linux distributions must patch their ca-certificates packages. The Python ecosystem has already acted, releasing uv 0.13.4, pip 26.2.2, and certifi 2026.10.19 with the necessary certificate list updates.
A GitHub repository is tracking software updates as the ecosystem responds to this critical compromise of the certificate authority supply chain.
Read the full article
Continue reading at Simon Willison →This is an AI-generated summary. Read the original for the full story.