On 21/10/2026 11:52, David Runge wrote:
Hi,
I would like to send the following news item asap:
```
On 2026-10-20 it was revealed, that [several certificates of the eMudhra
intermediate Certificate Authority have been
compromised](https://emudhra.we-have-a-problem.com/).
The compromised certificates have been removed/invalidated with
ca-certificates-mozilla >= 1.131.1-1.
Without an update to this central certificate bundle, systems are susceptible
to man-in-the-middle attacks.
As such, we urge everyone to upgrade their systems.
```
In case you have wording suggestions, please add them in the hedgedoc:
https://md.archlinux.org/P-DJtqUkRB6PxZUrFWJ80A?view
Best,
David
Apart from the fact that we have a security tracker for these kind of
announcements. This announcement is incomplete, for example chromium,
qt6-webengine is still affected and uv is missing which by default uses
their own CA Store. [1] [2]
The NixOS folks have compiled a list of packages which bundle their own,
the same very likely applies for our npm/cargo based packages. [2]
[1] https://github.com/NixOS/nixpkgs/pull/576558
[2]
https://gitlab.archlinux.org/archlinux/packaging/packages/qt6-webengine/-/work_items/16
[3] https://github.com/NixOS/nixpkgs/issues/576544
