Eight intermediate CA certificates issued by eMudhra have been compromised, exposing the private keys used to sign digital certificates for thousands of websites. These certificates chain back to root authorities trusted by Mozilla, Microsoft, Apple and Chrome, meaning any software bundling their trust lists requires an immediate update. Linux distributions must refresh their ca-certificates packages to prevent attackers from impersonating legitimate services. Recent releases of uv 0.13.4, pip 26.2.2 and certifi 2026.10.19 now include the corrected certificate bundles.
The incident matters because it undermines the foundational trust model securing internet communications. If an attacker controls a private key for an intermediate CA, they can issue valid certificates for any domain, allowing undetected interception of data. While the roots remain unbroken, the breach forces a global coordination effort to revoke trust before the damage spreads. The following packages require updates to reflect the revocation:
* Linux ca-certificates packages
* uv 0.13.4
* pip 26.2.2
* certifi 2026.10.19
