# eMudhra intermediate CA compromise forces urgent certificate updates across Linux, Python tools

> **Key takeaway:** Eight eMudhra intermediate CA private keys were compromised, requiring updates to ca-certificates packages and Python tools including uv, pip, and certifi.

**Published:** 2026-10-20T23:50:25+00:00 
**Source:** Simon Willison Web & Open Source 
**Category:** software-engineering 
**Canonical URL:** https://fosswire.org/news/emudhra-intermediate-ca-compromise-forces-urgent-certificate.html 

## Summary
The private keys of eight eMudhra intermediate CA certificates have been compromised. These certificates chain to root CAs trusted by major browser and OS root programs including Mozilla, Microsoft, Apple, and Chrome. Linux distributions must update their ca-certificates packages. In the Python ecosystem, uv 0.13.4, pip 26.2.2, and certifi 2026.10.19 have already been released with updated certificate lists.

## Affected software and required updates
- **Eight intermediate CA certificates**: eMudhra intermediate CAs whose private keys are now compromised
- **Root program coverage**: Chains to roots in Mozilla, Microsoft, Apple, and Chrome trust stores, plus downstream derivatives
- **Linux impact**: All distributions need ca-certificates package updates to remove or distrust the compromised intermediates
- **Python toolchain**: uv 0.13.4, pip 26.2.2, and certifi 2026.10.19 released with upgraded certificate bundles
- **Tracking**: Software updates being coordinated via a GitHub repository monitoring downstream responses

## Why it matters
Because the compromised intermediates chain to widely trusted roots, attackers with the private keys could issue valid-appearing certificates for any domain. The rapid response from Python tooling maintainers shows the severity; Linux distribution updates remain critical for system-wide TLS security.