Skip to content
Compromise of eMudhra Intermediate CA Certificates Requires Immediate Action

Compromise of eMudhra Intermediate CA Certificates Requires Immediate Action

First seen 21 Oct 2026, 21:09 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 13:44 UTC
  • •Eight eMudhra intermediate CA certificates' private keys have been compromised.
  • •Immediate updates to software relying on these certificates are required, especially for Python users.
  • •Failure to upgrade could lead to man-in-the-middle attacks against TLS clients.

The private keys of eight eMudhra intermediate CA certificates have been compromised, affecting root trust by major entities including Mozilla, Microsoft, Apple, and Chrome. This incident necessitates immediate updates to software that relies on these certificates, particularly for Python users who must upgrade pip to version 26.2.2 or higher. The compromised keys could facilitate man-in-the-middle (MITM) attacks against TLS clients, potentially impacting users of python.org and pypi.org. Users are advised to update their CA bundles and rebuild container images to ensure security. The incident has been confirmed by multiple sources, and ongoing updates will be provided as more information becomes available.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-18
Compromise of eMudhra CA certificates confirmed
The private keys of eight eMudhra intermediate CA certificates were confirmed compromised, affecting major root trust programs.
Simonwillison
2026-10-19
Updated certifi version released
Certifi 2026.10.19 was released to address the compromised certificates and should be used in conjunction with pip 26.2.2.
Discuss.Python
2026-10-20
Python package updates recommended
Users were urged to upgrade pip and uv to the latest versions to mitigate risks from the compromised certificates.
Discuss.Python

More articles in this cluster (7)

Following this threat?

Track emSign in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 3

Common questions

Which software needs updating?
Any software that bundles a list of trusted certificates, especially Python's pip and uv, needs to be updated.
What versions should I upgrade to?
Upgrade pip to version 26.2.2 or higher, and certifi to version 2026.10.19.
What are the risks if I don't update?
Failure to update could expose users to man-in-the-middle attacks, compromising secure communications.