Stolen keys let fake websites pass as trusted, so update your software

Private keys for eight certificates tied to eMudhra, a certificate authority, have been compromised. Those certificates chain to roots that Mozilla, Microsoft, Apple and Chrome trust. That means a fake website or connection could look genuine to software that still trusts them. Fixes are now being released.

What happened

A certificate authority is a company that vouches that a website is who it claims to be. Browsers and other software keep a list of authorities they trust. Keys are the secrets used to sign those certificates, so stolen keys are a serious problem. Security writer Simon Willison called the news "very, very bad."

Software that bundles its own list of trusted certificates needs an update. Linux distributions must update their ca-certificates packages. In the Python world, uv 0.13.4, pip 26.2.2 and certifi 2026.10.19 carry upgraded lists.

What to do and what is unknown

The alert box above lists the steps. The short version is to install pending updates and ask your IT provider or vendors to confirm their systems are patched.

Several things are not yet clear from the source. It does not say how the keys were compromised, whether anyone has used them to fake a site, or exactly when each browser and device will block them. Updates are still rolling out, so check back and keep automatic updates on.