---
type: "raw_signal"
id: "emudhra-intermediate-ca-compromise-107a10"
slug: "emudhra-intermediate-ca-compromise-107a10"
title: "eMudhra Intermediate CA Compromise"
description: "A report on the eMudhra intermediate CA compromise says private keys for eight intermediate certificates were compromised."
retrieval_nugget: "A report on the eMudhra intermediate CA compromise says private keys for eight intermediate certificates were compromised."
observed_at: "2026-10-21"
record_date: "2026-10-21"
date_kind: "observed_at"
why_it_matters: "The operational consequence is certificate-store maintenance: software that bundles trusted certificates needs an updated list. The report names uv 0.13.4, pip 26.2.2, and certifi 2026.10.19 as Python ecosystem releases with upgraded certificate lists, and says Linux distributions need to update their ca-certificates packages. The source does not specify the full scope of exploitation or establish"
novelty: "notable"
verification_level: "source-linked"
signal_type: "announcement"
source_platform: "simonwillison.net"
topics: []
entities: ["eMudhra","Mozilla","Microsoft","Apple","Chrome","uv","pip","certifi"]
related_patterns: []
novelty_label: "same_event"
what_changed: "Same event as 8 eMudhra certificates are compromised. Here's what you need to know | Cloudflare Blog"
prior_refs: ["memory:3e38c27f-0a72-8a2c-a003-3b2808d0c828","memory:43249e4d-9360-80ae-a611-f475468736c9"]
source_url: "https://simonwillison.net/2026/Oct/20/emudhra-certificates"
source_urls: ["https://simonwillison.net/2026/Oct/20/emudhra-certificates"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "signal:emudhra-intermediate-ca-compromise-107a10"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/signals/emudhra-intermediate-ca-compromise-107a10/","markdown":"https://newruntime.com/signals/emudhra-intermediate-ca-compromise-107a10.md","json":"https://newruntime.com/signals/emudhra-intermediate-ca-compromise-107a10.json"}
---

# eMudhra Intermediate CA Compromise

## Retrieval answer

A report on the eMudhra intermediate CA compromise says private keys for eight intermediate certificates were compromised.

A report on the eMudhra intermediate CA compromise says private keys for eight intermediate certificates were compromised. The certificates chain to roots trusted by Mozilla, Microsoft, Apple, and Chrome root programs, as well as many downstream trust stores.

The operational consequence is certificate-store maintenance: software that bundles trusted certificates needs an updated list. The report names uv 0.13.4, pip 26.2.2, and certifi 2026.10.19 as Python ecosystem releases with upgraded certificate lists, and says Linux distributions need to update their ca-certificates packages. The source does not specify the full scope of exploitation or establish that every deployment is affected; operators should check the trust stores their applications actually use.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- collection: [Raw Signals](https://newruntime.com/signals.json): Open every source-linked raw signal.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)