Security incidents tagged Uv. Newest first.
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.
eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA storesSince Oct 18, 2026
Sparrow v2.5.6 has been released, removing the eMudhra root certificates and upgrading the bundled Tor to meet the client protocols now required by the Tor network. It also brings extensive screen reader and keyboard accessibility improvements. Changelog: t.co/4YVq0yJBbg
Update: Microsoft has removed seven certificates associated with the affected eMudhra hierarchies from the Microsoft Edge trust list, following their removal from the Windows trust list. We’ve updated our guidance with additional information on these protections and what customers should consider when managing trust locally. Read the latest in our blog: t.co/5WQnB0WH3D
Following the eMudhra certificate authority incident, the Besu, Teku and Web3Signer teams have shared notes for operators. → Besu: t.co/6j5rLcLBbd → Teku: t.co/djHIQNiHaA → Web3Signer: t.co/EzUaF4SOyi t.co/GFRZ1PUFM4
CERT-In has published Advisory on its website. Multiple Vulnerabilities in Oracle Products t.co/UVCjvG7j9L Compromise of eMudhra Intermediate CA Certificates t.co/gixbWR83Vf
Sandboxes SDK 0.12.14 is live to patch the eMudhra certificate compromise. Update your `Dockerfile` to use the new image and redeploy. t.co/QBvp8tFeFy
Calling it now: Chrome and Mozilla will remove eMudhra as a G1 root, nulling them as a CA. On 20 Oct, eMudhra had 24 hours to give an explanation of what exactly happened with the mis-signed certificate. They did not; asked for more time; and now blame “investors/customers” 🤡 t.co/QcAqbC9Ghl
+14 more on the incident pages above.