Ethereum Clients Update After eMudhra Certificate Authority Compromise

• •Teku and Besu released updates to address a certificate authority compromise affecting Java runtimes.
• •Default mainnet nodes of Teku are not affected, but those using HTTPS connections must take action.
• •Operators need to verify their Java installations separately, as Java does not check for certificate revocation by default.

Ethereum clients Teku and Besu have released updates to address a security issue stemming from a compromise of eight eMudhra intermediate certificate authorities. The incident, reported on October 17, 2026, revealed that private keys were recoverable, leading to the revocation of the affected certificates on October 18. While Teku's default mainnet nodes are unaffected, those connecting to HTTPS endpoints must ensure their Java runtimes are updated, as Java does not check certificate revocation by default. The updates, Teku 26.10.3 and Besu 26.10.2, remove four compromised certificate roots from their Docker images. Users of binary installations must separately verify their Java environments to mitigate potential risks of man-in-the-middle attacks. The situation remains under control, with no confirmed exploitation reported as of now.