NR-03 · Deimos AI LLC · California, USA · 2026-10-21
Deimos AI LLC releases Wardlatch, a free check for the leaked eMudhra certificate keys.
Wardlatch checks whether your phone, browser and computer still trust the leaked eMudhra keys, and shows the fix. Free, at deimoscore.com/wardlatch.
On 20 October 2026 it became public that the private keys of 8 eMudhra intermediate certificate authorities had been generated so weakly that anyone could recover them from the public certificates. With one of those keys, anyone could issue a certificate for any website, and software that still trusts it would accept the fake site as real.
Firefox and Chrome blocked the certificates on 17 October, Apple devices on the 19th and Microsoft platforms on the 20th. Much of the rest of a computer waits for updates: curl, Node.js, Python’s certifi bundle, Go and Rust programs, Electron apps and container images each keep their own list of who to trust.
One tap in the browser, one command on a computer
Today Deimos AI LLC releases Wardlatch, a free check with no sign-up. In the browser, on phones too, one tap asks the browser to open the 12 public test sites the incident’s advisory set up, each signed with a compromised key. A protected browser refuses every one.
On a computer, npx wardlatch (version 0.1.0) asks every curl, Node.js and Python on the machine, each project’s Python environment and the operating system’s own trust store to connect to the same sites, the way their programs would. It prints the fix next to anything that connects.
Both checks run a control first. If the test sites can’t be reached, or a check couldn’t have failed, the result is “couldn’t test”, never “protected”. Wardlatch runs on the device, sends nothing about the person using it, and changes nothing.
This week’s other leaks
The command checks 4 incidents in all: the eMudhra keys; PHP’s fixes for two critical flaws, due on 21 October at 14:00 UTC; versions 0.11.0 to 0.15.0 of the OVHcloud command-line tool, swapped on GitHub for a secret-stealer on 19 October; and credential-stealing GitHub Actions workflows planted in tens of thousands of repositories since 7 October. The page also covers the week’s other incidents, from the breach at PingCAP, the company behind TiDB Cloud, to the State Bank of India’s disclosure, and sets out who is affected and what to do.
For businesses
The page sets out what a business should do this week: check every machine that builds or runs code, rebuild container images and compiled apps on fixed versions, replace certificates issued from eMudhra’s G3 roots (eMudhra estimates about 30,000 need replacing), and ask POS providers in writing whether their tills and terminals trust the leaked keys.
Most people don’t know their phone or laptop needs checking. Wardlatch is free and open source under the Apache License 2.0, and the page is built to be shared: www.deimoscore.com/wardlatch/.
Share this release
The facts in this item · from the Record
Each number is pinned as it stood when this item was published, 2026-10-21. The Record keeps the live value; if it moves, the row says so and this item’s text is not rewritten.
- 8eMudhra intermediate CA keys found compromised (6 for websites, 2 for code signing)Check it: eMudhra intermediate CA keys found compromised (6 for websites, 2 for code signing), on the Record
- 12Public test sites the Wardlatch checks connect to, each signed by a compromised eMudhra intermediateCheck it: Public test sites the Wardlatch checks connect to, each signed by a compromised eMudhra intermediate, on the Record
- 0.1.0Wardlatch, the free check: current version on npmCheck it: Wardlatch, the free check: current version on npm, on the Record
Since updated on the Record: 0.1.2, as of .
- 4Incidents the wardlatch command checksCheck it: Incidents the wardlatch command checks, on the Record
Since updated on the Record: 6, as of .
- about 30,000Website certificates that need replacing after the eMudhra compromise (eMudhra's own estimate)Check it: Website certificates that need replacing after the eMudhra compromise (eMudhra's own estimate), on the Record
Sources
Image pack
About Deimos AI LLC
Deimos AI LLC builds software that keeps people in charge of their AI agents: seen, approved, stoppable and provable. Its instruments include Ratchet, a live effect gate; Crimp, an open-source decision gate; Marklode, startup due diligence checked by a person; and Clockford™, whose private beta opens Nov 10th, 2026. It publishes a dated, sourced ledger of its claims. Defence only.
Media contact
No press inbox is published yet, and this site has no forms. Message Deimos AI LLC on LinkedIn, or use the contact page.