The compromise of eight private intermediate CA keys enables an attacker to issue trusted certificates for any website on the internet. While Chrome, Apple, and Firefox blocked the certificates within hours, the incident forced emergency patches from Go, Rust, Python, Ubuntu, and Arch. Systems including Debian and FreeBSD have patches pending. The breach is particularly acute because much of the open source ecosystem relies on bundled trust lists rather than active revocation checks.
Tuesday, October 20, 2026
Story
eMudhra's Compromised Keys Enable Fake Certificates for Any Website
Cybersecurity5 hours ago
The pip package manager released version 26.2.2 and the uv tool released version 0.13.4 to mitigate a security crisis involving the eMudhra certificate authority. These updates target bundled certificates provided by libraries such as certifi and webpki-root-certs, which otherwise remained vulnerable to stolen credentials. To prove the severity of the breach, a reporter used all eight compromised keys to sign a note stating, "We have a problem here."
Looking for more context or analysis?
Tilt chat provides reliable, tailored insights, alerts, and automations.