From We Have A Problem · · 2m
eMudhra Intermediate CA Compromise
Eight eMudhra intermediate CA certificates compromised, affecting millions of devices.
In brief
Eight eMudhra intermediate CA certificates compromised, affecting millions of devices. Attackers could impersonate any website using compromised eMudhra intermediate CA certificates. Originally reported by We Have A Problem.
Compromised Certificates
Eight eMudhra intermediate CA certificates have been compromised, chaining to roots trusted by Mozilla, Microsoft, Apple, and Chrome.
“We have a problem here - Wayne”
How We Know
Wayne signed messages with the private keys of each compromised intermediate CA and reported them to Root Program Teams on October 17, 2026.
Immediate Actions
Root programs blocked the certificates in Firefox and Chrome since October 17, Microsoft since October 20, and Apple since October 22, 2026.
Consequence
Attackers could impersonate any website or service using the compromised intermediate CA certificates.
Remediation
Mozilla, Microsoft, Apple, and Chrome have remediated the issue through revocation tools like OneCRL, CRLite, and CRLSets.
Compromised Intermediates
The eight compromised intermediates chain to roots including emSign ECC Root CA - G3 and AAA Certificate Services.
Clients at Risk
Electron apps like Slack and Discord require updates to stop trusting the compromised intermediates.
Certificate Transparency
Two chains marked No CT were added on October 22, 2026, meaning clients that enforce CT reject them even if they trust the intermediate.
Client Patches
Operating systems, software, and applications have patched their trust stores to block the compromised intermediates.
User Workarounds
Users can remove affected roots from their system trust stores to block the compromised intermediates.
Root Cause
The private keys were incorrectly generated by the CA, allowing anyone to recover them from the certificates.
Timeline
The issue was responsibly disclosed on October 19, 2026, with many trust stores releasing updates by October 22.
Affected Systems
The compromised intermediates affect systems including macOS, Linux, Windows, Android, and NetBSD.
Patch Details
Distributions like Debian, Ubuntu, and Fedora have updated their ca-certificates packages to block the compromised intermediates.
Next Steps
Users should update their browsers and operating systems to the latest versions to prevent further compromise.
What to remember
Attackers could impersonate any website using compromised eMudhra intermediate CA certificates.
