According to a post by Simon Willison published on 20th October 2026, the private keys of eight eMudhra intermediate certificate authority (CA) certificates have been compromised. Willison describes the development as 'very, very bad news.' The affected certificates chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores, meaning a wide range of software that relies on these trust chains is potentially affected. Per the post, any software that bundles a list of trusted certificates needs to be updated. Willison references a GitHub repository tracking software updates, and notes that Linux distributions need to update their ca-certificates packages. In the Python ecosystem, the post states that uv 0.13.4, pip 26.2.2 and certifi 2026.10.19 have been released with upgraded certificate lists. The report is based on a single tier-two source summarizing the compromise and pointing to affected and updated software; the specifics of how the compromise occurred are not detailed in the excerpt. Readers maintaining systems that depend on these trust stores are directed to the tracking repository for the current list of required updates.
- Private keys for eight eMudhra intermediate CA certificates were reported compromised
- The certificates chain to roots trusted by Mozilla, Microsoft, Apple and Chrome
- Linux distros need updated ca-certificates packages; uv 0.13.4, pip 26.2.2 and certifi 2026.10.19 ship upgraded certificate lists
- Reported by Simon Willison on 20th October 2026, citing a GitHub tracking repository
What it means for you
A set of digital certificates that your systems trust to prove websites and software are legitimate have had their underlying secret keys exposed. That trust needs to be revoked, which means software across your stack — operating systems, servers, build tools — has to pull in updated lists of what to trust. If you run or depend on technical systems, this is patch-now housekeeping, not an abstract threat.
Try this
Ask whoever manages your servers and developer tooling to check that their systems are pulling current certificate lists this week — on Linux that means updating ca-certificates packages, and for Python teams updating uv, pip and certifi to the versions noted. The linked GitHub repo tracks what still needs updating.
Who should care
Whoever owns your IT infrastructure, DevOps or security — anyone responsible for servers, CI/CD pipelines, or developer environments that validate certificates.
Skip this if
You don't run your own servers or developer tooling and rely entirely on managed platforms — in that case your vendors handle this, though you may confirm with them if security is contractual.
Sources: Simon Willison — read the original