eMudhra Intermediate CA Compromise
The private keys of eight eMudhra intermediate CA certificates have been compromised, and these certificates chain to roots trusted by Mozilla, Microsoft, Apple and Chrome. Any software that bundles a trusted certificate list must be updated, and patched releases such as uv 0.13.4, pip 26.2.2 and certifi 2026.10.19 have already shipped. Why it matters: a compromised CA can forge certificates for any site, undermining the trust backbone of HTTPS until every downstream trust store is patched.
SOURCES
- Simon Willison2026-10-20 23:50