eMudhra Intermediate CA Compromise

eMudhra Intermediate CA Compromise. This is very, very bad news:

The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.

Any software that bundles a list of trusted certificates needs to be updated. This site is tracking software updates via this GitHub repository - Linux distros need to update their ca-certificates packages.

In Python world uv 0.13.4 and pip 26.2.2 and certifi 2026.10.19 have been released with upgraded certificate lists.

This is a link post by Simon Willison, posted on 20th October 2026.

Sponsor me for $10/month and get a curated email digest of the month's most important LLM developments.