According to a report published on October 20, 2026, the private keys of eight eMudhra intermediate certificate authority (CA) certificates have been compromised. These certificates chain to root certificates trusted by Mozilla, Microsoft, Apple, and Chrome root programs, as well as many downstream trust stores.
A reporter identified as Wayne discovered the compromise and demonstrated it by signing a message with each of the eight intermediate CA private keys, providing cryptographic proof of the breach. The certificates include EM-DV-TLS-CA-G3B and others that were distributed across multiple trust ecosystems.
An attacker possessing any of these private keys could impersonate any website or service, representing a significant security risk across the internet infrastructure.
In response, major browser and operating system vendors moved quickly to protect users. According to the report, Firefox and Chrome blocked the certificates starting October 17, Apple devices since October 19, and Microsoft since October 20. The issue was disclosed to downstream trust stores on October 19, with many already releasing updates or in the process of doing so.
Mozilla, Microsoft, Apple, and Chrome remediated the issue for their users through revocation distribution tools including OneCRL, CRLite, and CRLSets. The CA also revoked the compromised intermediate certificates. However, many client systems do not consume revocation information and require software updates to stop trusting the compromised intermediates.
Numererous software projects have released patches, including Ubuntu ca-certificates (versions 20260816 for multiple Ubuntu releases), Go (1.27.3, 1.26.10), Electron (44.9.1, 43.8.1, 42.11.16), Python certifi (2026.10.19), Rust rustls-webpki (0.103.16), NSS (3.131.1), and others. Node.js and Composer ca-bundle patches were listed as pending at the time of publication.
The report recommends users update their browsers and operating systems to the latest versions as soon as possible. For systems running macOS, special instructions were provided, as the built-in curl client verifies certificates against a certificate file that was not automatically updated with revocation information.
Key facts
- Eight eMudhra intermediate CA private keys were compromised and could be used to impersonate any website or service
- The affected certificates chain to roots trusted by Mozilla, Microsoft, Apple, Chrome, and many other trust stores
- Mozilla and Chrome blocked the certificates October 17; Apple followed October 19; Microsoft October 20
- The CA revoked the compromised certificates, but many clients require software updates since they do not consume revocation information
- Patches have been released for major software including Ubuntu, Go, Electron, Python certifi, Rust, and NSS