Security · High impactFan score 45 · Tier B3 sources
eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise
The Hacker News ·
The Brief · written from 3 sources
- The eMudhra intermediate Certificate Authority compromise was reported on October 20, 2026.
- Browsers blocked the compromised eMudhra CA keys within hours, according to foojay.io.
- The Python Software Foundation and foojay.io have published accounts of how their ecosystems responded.
Why it matters
A compromised intermediate CA undermines the HTTPS trust chains that software depends on, so developers need to check how their stacks handle certificate trust and revocation.
Who’s affected
- Python ecosystem users
- Java estates
What to do
- Consider security-only Java patching to shorten testing and response time, as suggested by foojay.io
The in-house Python script behind eMudhra's October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys. Each intermediate CA has its own private key, which the company uses to sign the…
Timeline
eMudhra intermediate CA compromise reported
foojay.io - Friends Of OpenJDK
Java Patching at Incident Speed: Lessons from the eMudhra CA Compromise
Python Software Foundation News
How the Python ecosystem responded to the eMudhra intermediate compromise
The Hacker News
eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise
Full coverage · 3 sources
- 2h ago ↗
The Hacker News
eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise
- 6d ago ↗
Python Software Foundation News
How the Python ecosystem responded to the eMudhra intermediate compromise - 7d ago ↗
foojay.io - Friends Of OpenJDK
Java Patching at Incident Speed: Lessons from the eMudhra CA Compromise