eMudhra intermediate CA compromise forces urgent certificate updates across Linux, Python tools
Eight eMudhra intermediate CA private keys were compromised, requiring updates to ca-certificates packages and Python tools including uv, pip, and certifi.
Summary
The private keys of eight eMudhra intermediate CA certificates have been compromised. These certificates chain to root CAs trusted by major browser and OS root programs including Mozilla, Microsoft, Apple, and Chrome. Linux distributions must update their ca-certificates packages. In the Python ecosystem, uv 0.13.4, pip 26.2.2, and certifi 2026.10.19 have already been released with updated certificate lists.
Affected software and required updates
- Eight intermediate CA certificates: eMudhra intermediate CAs whose private keys are now compromised
- Root program coverage: Chains to roots in Mozilla, Microsoft, Apple, and Chrome trust stores, plus downstream derivatives
- Linux impact: All distributions need ca-certificates package updates to remove or distrust the compromised intermediates
- Python toolchain: uv 0.13.4, pip 26.2.2, and certifi 2026.10.19 released with upgraded certificate bundles
- Tracking: Software updates being coordinated via a GitHub repository monitoring downstream responses
Why it matters
Because the compromised intermediates chain to widely trusted roots, attackers with the private keys could issue valid-appearing certificates for any domain. The rapid response from Python tooling maintainers shows the severity; Linux distribution updates remain critical for system-wide TLS security.
What to do
- Linux users should update their ca-certificates package when their distribution releases an update.
- Python users should update uv to version 0.13.4, pip to version 26.2.2, and certifi to version 2026.10.19.
- Anyone managing software that bundles trusted certificates should monitor the GitHub repository tracking downstream responses for available updates.
Original reference: simonwillison.net →