Wardlatch · Free · Open source · Works on phones
When a certificate authority’s keys leak, browsers block them first. The rest of your machine waits for updates. Wardlatch tells you what still trusts the leaked eMudhra keys, on your phone, your computer and your business’s systems, and how to fix each one.
eMudhra intermediate keys compromised: 6 that sign website certificates, 2 that sign code.
Each key was a number under 256; one of them was 4. Anyone could recover it from the public certificate.
Website certificates eMudhra says now need replacing (its own estimate).
Downloads of Python’s certifi bundle last month. Every copy older than 2026.10.19 still trusts the keys.
From the report to Mozilla’s block on 17 October. Most other software needed an update; some still does.
Of the 24 trust lists in the advisory’s table with no fix yet: Node.js, Bun and FreeBSD.
Pulls of the official Alpine container image, last rebuilt on 18 September, before Alpine’s fix. Containers built from it need apk upgrade.
Downloads last month of requests, Python’s most used web library. It trusts whatever certifi sits beside it.
Certificate Transparency entries for these intermediates since April 2025, so browsers that require them were never exposed.
Sources · The Register (the key that was 4) · Mozilla’s incident report, bug 2083449 (comments 0, 5 and 19; the 30,000 is eMudhra’s figure) · pypistats.org (certifi, requests) and Docker Hub (alpine), read 21 Oct 2026 · the advisory’s table, read 21 Oct 2026.
Seven steps, in order. Each links to the part of this page that does it.
chrome://components and check “CRLSet” for an update.npx wardlatch. It tests every node, curl and python3 and each Python environment, and prints the fix for anything exposed (more).Smart TVs, streaming boxes, routers, printers, cameras and older tablets make secure connections too, and each keeps its own trust list. Open each one’s settings and install any system or firmware update. A device whose maker has stopped sending updates may keep trusting the leaked keys for years: don’t use it for banking, shopping or work logins until it can be replaced. Running a home server? See home servers. Running a business? Start at what businesses should do.
Works on phones, tablets and computers. Your browser tries to open 12 test sites whose certificates are signed with the compromised keys. A browser that still trusts those keys connects; a protected one refuses.
Nothing is fetched until you press the button.
How it works: before the test sites, your browser opens the advisory’s own page, which has a normal certificate. If that fails too, the result is “couldn’t test” (you may be offline, or a blocker stopped it), never “protected”. The 12 test sites and the list of affected roots come from the public advisory at emudhra.we-have-a-problem.com. This page sends nothing about you anywhere; it sets no cookies.
What your result covers. On an iPhone or iPad, every browser uses Apple’s system, so the result is iOS’s own answer. On a Mac, Safari’s result is macOS’s answer; Chrome and Firefox keep their own lists. On Android and Windows, the result covers the browser only: apps use the system’s list, which a system update fixes (§02). On a computer, npx wardlatch also checks the operating system’s own trust (§03).
How does this browser treat other bad certificates? It tries five public test pages on badssl.com: expired, from an unknown authority, self-signed, issued for another site, and revoked. An up-to-date browser refuses the first four; whether it refuses the revoked one depends on the browser.
badssl.com is a public test site for checking how browsers handle certificates. As with the main check, nothing is sent until you press the button, and nothing about you is kept.
The leaked keys let someone pretend to be any website, but only to a device or program that still trusts them, and only from a position in its network path: public Wi-Fi, a compromised router, a hostile network. From there they could read or change what that device sends and receives.
No misuse has been reported, and up-to-date browsers were never exposed (§09). For a business, it’s reasonable to treat secrets sent by an exposed server over networks you don’t control as worth rotating, once that server is fixed.
Apple blocks the compromised certificates for Safari and its apps (Settings → General → Software Update keeps that current), then check again. On a Mac that isn’t the whole fix: the built-in curl, git, python3 and openssl still trust them until you run the one-line test and the macOS fix. Also update Chrome, Edge or Firefox if you use them.
Update Chrome from the Play Store; it blocks the certificates on its own. Apps use Android’s own trust list: on Android 14 and later it can be updated through Settings → Security & privacy → System & updates → Google Play system update. Phones that no longer get updates may stay exposed for apps.
Microsoft platforms block the certificates since 20 October: Settings → Windows Update → Check for updates, then check again. Python and Node.js on Windows keep their own lists; see the fix commands.
Open chrome://components (Edge: edge://components), find “CRLSet” and press “Check for update”. Then check again. A new or rarely opened Chrome is exposed until that list arrives: in our own test on 21 Oct 2026, a fresh Chrome profile connected to 6 of 12.
Menu → Help → About Firefox installs the latest version. Firefox has blocked the certificates since 17 October.
Anything that connects to the internet keeps its own trust list. Open each device’s settings and install the latest system or firmware update. If the maker no longer sends updates, keep it away from logins, payments and work until it can be replaced.
Your browser isn’t the only thing that trusts keys. curl, Node, Python and every project’s own certificate bundle keep their own lists, and each one has to be fixed on its own. On a computer, one command checks them all.
npx wardlatchIt checks the operating system’s own trust (on macOS, the layer Safari and Apple’s apps use; on Linux, the distribution’s certificate store), then asks every node, curl and python3 on your path, and the Python environments in your project folders, to connect to the same 12 test sites, the way your own code would. Each runtime is first tested with the compromised roots forced in, so a check that couldn’t have failed reports “could not be tested”, never “safe”. It also checks this week’s other incidents (§08): cloudflared and Go versions, the hijacked OVHcloud CLI versions, an installed PHP awaiting its fix, compromised WordPress plugins (Rank Math PRO, UpdraftPlus) on any site it finds, GitHub workflow files added to your repositories since 1 September, and keys committed to your code. It runs on your machine, sends nothing anywhere except the connections to the test sites, and changes nothing: each result comes with the fix for you to apply. The source is on GitHub (Apache-2.0).
SAFE macOS system (Safari and Apple apps) 26.7.1
SAFE node 26.12.0 /opt/homebrew/bin/node
EXPOSED node 26.12.0 /usr/local/bin/node trusts 6/12
fix: Node bundles its own roots; the fix is merged upstream, awaiting a release …
SAFE curl 8.7.1 /usr/bin/curl
SAFE certifi 2026.10.19 ~/Development/app/.venv
SAFE cloudflared 2026.10.2 /opt/homebrew/bin/cloudflared
OVHcloud CLI releases swapped for a secret-stealer (2026-10-19)
SAFE ovhcloud not installed
9 safe · 1 exposed · 0 could not be testedExample output from one of our own machines on 21 Oct 2026, after the fixes. Phones can’t run commands; §01 checks a phone’s browser, and a system update covers its apps.
The leaked keys will last longest in the long tail: containers nobody rebuilds, a Raspberry Pi nobody has updated in a year, a camera whose maker stopped shipping firmware. Browsers were fixed in days. These are fixed only when someone fixes them.
curl -s -o /dev/null https://dv-g3b-emudhra.we-have-a-problem.com/; case $? in 0) echo EXPOSED;; 60) echo SAFE;; *) echo UNKNOWN;; esacEXPOSED: update the certificate store (below). SAFE: the system list refuses the leaked keys. UNKNOWN: the test site didn’t answer; try again. On a server with Node 18 or later, npx wardlatch checks the rest, every running Docker and Podman container included, each from inside.
Debian, Ubuntu, Raspberry Pi OS and Proxmox VE: sudo apt update && sudo apt install --only-upgrade ca-certificates. Fedora and RHEL: sudo dnf upgrade --refresh ca-certificates. Alpine: apk upgrade ca-certificates. The fixed versions are in §05, the other systems in the fix picker. Then run the test line again.
Updating the host doesn’t fix a container. Images you build: docker build --pull --no-cache once the base image has the fix. Images you pull: docker compose pull && docker compose up -d once the maintainer ships a fixed image. npx wardlatch on the host tells you which running containers still trust the keys.
Appliances ship their own certificate store with their firmware: install the latest update from the vendor’s updater and read its security notes. Don’t hand-edit system files on an appliance; an update overwrites them, and a mistake can lock you out. Until it’s fixed, keep its admin page off the internet.
PHP’s fixes for two critical flaws are due on 21 October at 14:00 UTC (see §08). Update the PHP package or the app’s container image as soon as they’re out, and keep admin pages behind a VPN or your local network until then. npx wardlatch checks the php on your path and WordPress plugins.
A device whose maker has stopped shipping firmware may trust the leaked keys for good. Put it on a guest network or its own VLAN, block its internet access if it doesn’t need it, never sign in to anything important on it, and replace it when you can.
The keys only help someone in your network path. Update the router’s firmware, change its admin password, turn off remote administration and UPnP, and use encrypted DNS (DNS over HTTPS or TLS) on the router or on your Pi-hole or AdGuard Home, so DNS answers can’t be tampered with on the way to you.
Software signed through them can look legitimate to a system that still trusts them. Keep Windows updated: Microsoft blocks the compromised intermediates since 20 October. On servers, install from your distribution’s repositories: apt, dnf and apk check packages against the distribution’s own signing keys, not website certificates, so a forged certificate alone can’t slip a package past them.
services:
app:
volumes:
- /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro
environment:
SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
REQUESTS_CA_BUNDLE: /etc/ssl/certs/ca-certificates.crtUpdate the host’s ca-certificates first: this mounts the host’s fixed bundle over the container’s, read-only, and points Python’s libraries at it. It covers programs that read the system bundle (curl, wget, OpenSSL, Go, Python). Node.js and Java keep their own lists and need their own fix. The paths are for Debian, Ubuntu and Alpine hosts and images; Fedora and RHEL use /etc/pki/tls/certs/ca-bundle.crt. Restart the container, then check it with npx wardlatch.
Each command comes from the advisory or the vendor’s own fix. This page only shows them: nothing runs, nothing is sent.
sudo cp /etc/ssl/cert.pem /etc/ssl/cert.pem.bak && sudo awk '/^(###|===) /{skip=0} /^=== .*\/CN=(AAA Certificate Services|emSign ECC Root CA - G3)$/{skip=1} !skip' /etc/ssl/cert.pem.bak | sudo tee /etc/ssl/cert.pem > /dev/nullmacOS blocks the intermediates for Safari and its apps, but the built-in curl, git, python3 and openssl read /etc/ssl/cert.pem, which no macOS release has updated yet. This backs the file up, then removes the two affected roots. It asks for your Mac’s password. To undo it: sudo cp /etc/ssl/cert.pem.bak /etc/ssl/cert.pem
Then run npx wardlatch again: a fix you can’t see working isn’t finished.
| Software | Fixed in |
|---|---|
| Ubuntu ca-certificates | 20260816ubuntu0.22.04.1 · 0.24.04.1 · 0.26.04.1 · 0.26.10.1 |
| Debian ca-certificates | 20250419~deb12u2 · 20250419+deb13u1 · 20260816+nmu1 |
| Fedora ca-certificates | 2026.2.92_v9.0.319 |
| Alpine ca-certificates | 20261020-r0 |
| Arch ca-certificates-mozilla | 3.131.1-1 |
| Gentoo ca-certificates | 20260816.3.125 |
| Chainguard ca-certificates | 20260909-r3 |
| FreeBSD ca_root_nss | pending |
| Homebrew ca-certificates | 2026-09-25_1 |
| NSS | 3.131.1 |
| curl CA bundle | 2026-10-20 |
| Cloudflare CFSSL trust store | 2026.10.1 |
| Python certifi | 2026.10.19 |
| pip | 26.2.2 |
| uv | 0.13.4 |
| Go | 1.27.3 · 1.26.10 (then rebuild) |
| Node.js | pending (fix merged 20 Oct, awaiting a release) |
| Bun | pending |
| Electron | 44.9.1 · 43.8.1 · 42.11.16 |
| Rust rustls-webpki | 0.103.16 |
| Rust webpki-roots / webpki-root-certs | 1.0.10 |
| Composer ca-bundle | 1.4.16 · 1.6.0 |
| Elixir castore | 1.0.22 |
| Perl Mozilla::CA | 20261020 |
Source · the advisory’s table, read 21 Oct 2026. “Pending” means no fixed release yet; §04 shows what to do meanwhile.
Most sites are unaffected: their certificate comes from another authority. Type your domain and copy the command; it prints who issued your certificate.
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -issuerIf the issuer names eMudhra or emSign, replace the certificate with one from another authority, even if it came from an intermediate that wasn’t compromised: Mozilla has removed trust in the emSign ECC Root CA - G3 altogether, Chrome has committed to the same, and eMudhra has stopped issuing under it. The domain you type stays on this page; nothing is sent.
curl -sI https://example.com/ | grep -i -E "x-powered-by|server:"A line such as X-Powered-By: PHP/8.3 means the site runs PHP and says which version: patch it when the fix lands. No such line doesn’t prove the site has no PHP, since many sites hide it; ask your developer or host. Hiding the header is worth doing too.
Running a service that other programs connect to? Those programs need the fixes in §04, not your server. In CI, npx wardlatch --json exits 0 when everything is safe, 1 when something is exposed and 2 when something couldn’t be tested.
Any organisation whose servers, containers, build systems or devices make HTTPS connections. Browsers on managed laptops are mostly covered; the risk sits in everything else.
Run npx wardlatch --json on developer machines, build servers and CI. The exit code fails a pipeline while anything is still exposed.
Rebuild container images on a fixed base, and rebuild Go, Rust and Electron apps with the versions in §05, then redeploy. A running copy changes nothing until it is replaced.
Check who issued your sites’ and APIs’ certificates (§06). eMudhra estimates about 30,000 need replacing.
Kiosks, embedded devices, old phones and appliances that no longer get updates may trust the keys for years. Treat them as exposed: keep them on networks you control and plan their replacement.
Two compromised intermediates were for code signing. If your systems accept code signed through eMudhra, review what they would accept and update their trust lists the same way.
Card terminals usually talk only to their payment processor, often with certificates the processor controls. Tills and kiosks running Windows or Android, and back-office PCs, use the system’s list. Ask your POS provider in writing whether their devices and software trust the eMudhra roots and when they update; install system updates on every till and kiosk.
Checkout code on your servers sends card tokens and API keys to the payment provider. Run npx wardlatch where that code runs, rebuild its container on a fixed base, and rotate payment API keys if the server was exposed. PCI DSS asks for an inventory of trusted certificates and that certificates protecting card data are valid and not revoked (requirements 4.2.1 and 4.2.1.1).
A fix you can’t see working isn’t finished. Run the check again and keep the result with the change.
As of 21 October 2026. Each one says who is affected and what to do; where npx wardlatch checks it, the card says so.
Remote code execution, rated 9.2, details out before the patch. Anyone running PHP sites or apps (WordPress, many online shops): update the moment your version’s fix is out, or ask your host when it will. Old, unsupported PHP versions may get no fix at all. Wardlatch flags an installed PHP.
For up to 94 minutes (12:47 to 14:21 UTC), versions 0.11.0 to 0.15.0 of the OVHcloud command-line tool on GitHub were replaced with malware that reads secrets from disk. Installed or updated then? Move to 0.16.0 and revoke every secret that machine held. Wardlatch flags those versions.
Hijacked accounts have committed credential-stealing workflow files to tens of thousands of repositories. Check every workflow you didn’t write; delete unknown ones and rotate the secrets your Actions can read. Wardlatch lists workflow files added to your repositories since 1 September.
One operator’s AI agents probed more than 1,200 websites and broke into more than 100, Reuters reported; the attacker’s exposed control panels held hundreds of stolen credentials. Patch your web apps, keep admin and agent panels off the open internet, and rotate keys that sit in website code.
October’s updates fix a record of more than 1,400 flaws, including CVE-2026-96951, a Windows Shell flaw attackers already use to make downloaded files look safe. Run Windows Update on every PC, till and kiosk.
SBI told the BSE and NSE that its threat-intelligence provider, the Defence Cyber Agency and CERT-In alerted it on 16 October. Of about 375,000 records found on the dark web, 3,897 hold customers’ personal details: names, gender, dates of birth, mobile numbers, emails, home addresses, branch and customer (CIF) numbers, and loan-record data. SBI’s list includes no account numbers, card details, passwords or OTPs. SBI says it has yet to confirm the data is genuine or find its source; an independent firm on CERT-In’s panel is investigating. Expect calls and messages that know your name, branch or loan. SBI never asks for an OTP, PIN or password: hang up and call 1800 1234 or the number on your card. What to do.
Denmark’s population register (8.8 million people, through one leaked password), SOURCENEXT in Japan (22.5 million records with passwords), Burger King Japan (11.2 million) and others. Check your email at Have I Been Pwned ↗, change any password you reuse, and turn on two-step sign-in.
Cloudflare says its tunnel tool and its WARP and 1.1.1.1 apps carry their own trust lists: update cloudflared to 2026.10.2 or later and the apps to their latest versions. Wardlatch checks cloudflared and the Go toolchain.
PingCAP confirms that stolen service-account credentials gave an attacker access to its internal systems from 9 September to 7 October, and that TiDB Cloud account details were copied. The attackers claim support tickets held customers’ production keys; PingCAP says that is unverified. TiDB Cloud customers: rotate your API keys and any credential you ever shared with PingCAP support. The lesson for everyone: a key pasted into a ticket, chat or email lives in someone else’s system, so share secrets through a vault or a link that expires.
Rank Math PRO 3.0.123 shipped with a backdoor (downloads 15 Oct 20:02 to 16 Oct 07:12 UTC): if it was activated, restore the site from a clean backup, then install 3.0.124; updating alone doesn’t remove it. After a breach at TeamUpdraft, stolen UpdraftCentral keys were used to plant backdoor plugins: update UpdraftPlus to 1.26.13 (premium 2.26.13), delete its UpdraftCentral keys, and look for administrator accounts and plugins you don’t recognise. Wardlatch flags both on a server and lists plugins added since 18 October.
A cyber incident at Ahold Delhaize took the websites and apps of Food Lion, Stop & Shop, Hannaford and Giant offline until 20 October. The company hasn’t said what data was involved. Watch for emails and texts about refunds or orders that ask you to sign in or pay: go to the app or site yourself instead of following the link.
We found no Apple advisory behind the viral post. The last iPhone flaw used in attacks (in CoreGraphics) was fixed on 28 September in iOS 26.7.1; update to the latest iOS anyway. Android’s October bulletin fixes 25 flaws, none reported as exploited.
Sources · PHP: Qualys, Huntress · OVHcloud: The Hacker News · GitHub Actions: The Hacker News · AI agents: The Hacker News, TechRadar (Reuters) · Windows: SecurityWeek · Breaches: Malwarebytes, ASCII, TechRadar · Cloudflare: Cloudflare blog · PingCAP: PingCAP security update · SBI: SBI’s filing to BSE and NSE (21 Oct), The Hindu (PTI), The Indian Express, SBI customer care · WordPress: BleepingComputer, Patchstack · Food Lion: WRAL · iPhone: Bitdefender · Android: Android Security Bulletin. All read 21 Oct 2026.
The private keys of eight eMudhra intermediate certificate authorities (six for websites, two for code signing) were generated incorrectly: each was a number under 256, so anyone could recover it from the public certificate. With one, an attacker could issue a certificate for any website or service. The problem was reported to the browser root programs on 17 October 2026 and made public on 20 October. Firefox and Chrome have blocked the certificates since 17 October, Apple devices since the 19th and Microsoft platforms since the 20th. Many other tools don’t read those block lists, and still trust the roots the intermediates chain to: AAA Certificate Services (through a Sectigo cross-sign) and emSign ECC Root CA - G3 (through emSign Root TLS CA - G3).
Sources · emudhra.we-have-a-problem.com (published by Dennis Jackson) and Mozilla’s bug 2083449, read 21 Oct 2026. When the next incident happens, Wardlatch adds its test sites and the same check covers it.
On 20 October 2026 it became public that the private keys of eight eMudhra intermediate certificate authorities had been generated so weakly that anyone could recover them from the public certificates. With one of those keys, an attacker could issue a certificate for any website, and any software that still trusts it would believe the fake site is real. Six of the keys sign website certificates; two sign code.
Up-to-date Chrome, Edge, Firefox and Safari block the certificates. What can still be exposed: browsers that haven’t updated, phones and devices that no longer get updates, and the tools on a computer that keep their own trust lists (curl, Node.js, Python and its certifi bundle, Go and Rust programs, Electron apps, container images). Press Check this browser on each device, and run npx wardlatch on a computer.
On an iPhone or iPad, yes: every browser there uses Apple’s system, so the result is iOS’s own answer. On a Mac, the result from Safari is macOS’s answer, and npx wardlatch also checks the macOS layer that Apple’s apps use. On Linux, the command checks the distribution’s certificate store. On Android and Windows, the browser check covers the browser only; apps there use the system’s list, which the latest system update fixes.
Press Check this browser on this page, on each phone, tablet and computer you use. Your browser tries to open 12 test sites signed with the compromised keys; “Did not connect” on all 12 means it is protected. It takes about ten seconds and sends nothing about you anywhere.
Keep the system updated (Settings → General → Software Update on iPhone and iPad; System Settings → General → Software Update on a Mac); Apple devices block the certificates for Safari and Apple’s apps since 19 October. On a Mac that isn’t the whole fix: the built-in curl, git, python3 and openssl read the file /etc/ssl/cert.pem, which no macOS release has updated yet. Run the one-line test, then the macOS fix if it says EXPOSED.
SBI hasn’t offered a way to check, and hasn’t said whether it is telling the people affected. Its filing says that of about 375,000 records found on the dark web, 3,897 hold customers’ personal details: names, gender, dates of birth, mobile numbers, emails, home addresses, branch and customer (CIF) numbers, and loan-record data. Assume a caller may know those details: SBI never asks for an OTP, PIN, CVV or password, so hang up and call 1800 1234 or the number on your card. In YONO, switch off international and online card use until you need it; if money leaves your account, call SBI on 1800 11 1109 and the national helpline 1930 (or go to cybercrime.gov.in) at once. The seven steps have the sources.
Update the server’s ca-certificates package (Debian, Ubuntu, Raspberry Pi OS and Proxmox: sudo apt update && sudo apt install --only-upgrade ca-certificates), then remember that each container keeps its own image’s list: rebuild your images with --pull, or pull the maintainer’s fixed image. For an image nobody maintains, mount the host’s fixed bundle into it read-only. npx wardlatch on the host checks every running Docker and Podman container from inside. Home servers has each step, NAS appliances, routers and smart devices included.
In Safari and Apple’s apps, yes. In Terminal, probably not. The Mac’s built-in curl, git, python3 and openssl read /etc/ssl/cert.pem, and the newest macOS releases (27.0.1, 26.7.1 and 15.8.1) all shipped on 28 September, before the keys were reported on 17 October, so none of them carries a fixed file. Test it by pasting this into Terminal: /usr/bin/curl -s -o /dev/null https://dv-g3b-emudhra.we-have-a-problem.com/; case $? in 0) echo EXPOSED;; 60) echo SAFE;; *) echo UNKNOWN;; esac. EXPOSED means run the Mac fix (a download that checks its own work and keeps a backup) or the advisory’s one-line macOS fix. Field Note 07 has the measurement.
The git that comes with the Mac does, until /etc/ssl/cert.pem is fixed: it checks HTTPS certificates against that file (run any git command with GIT_CURL_VERBOSE=1 and it prints CAfile: /etc/ssl/cert.pem). On 21 October, on macOS 26.7.1 with every update installed, git connected to a test site signed with a compromised key using the file as Apple shipped it, and refused once the two affected roots were removed. Someone holding a key and sitting in your network path could serve a fake repository to git clone. The macOS fix covers git, curl, python3 and openssl at once.
Update Chrome from the Play Store; it blocks the certificates itself. Apps use Android’s own trust list: on Android 14 and later it can be updated through Settings → Security & privacy → System & updates → Google Play system update. Phones that no longer receive updates may stay exposed for apps, so avoid using them for banking or work until they can be replaced.
Run Windows Update; Microsoft platforms block the certificates since 20 October, and that covers Edge and most Windows apps. Python, Node.js and some developer tools on Windows keep their own trust lists: upgrade certifi in each Python environment (py -m pip install -U "certifi>=2026.10.19") and see the fix commands for the rest.
Yes, if you use them. certifi 2026.10.19 is fixed; Go 1.27.3 and 1.26.10 are fixed, and every Go program must be rebuilt; Node.js’s fix is merged but not yet released, so run it with --use-openssl-ca on an updated system bundle until it does. The patched versions table lists 24 trust lists and where each stands.
Only if it was issued by eMudhra (emSign). Type your domain in §06 to get the one-line command that shows your certificate’s issuer. If it names eMudhra or emSign, replace it: Mozilla has removed trust in the emSign ECC Root CA - G3 altogether, and eMudhra estimates about 30,000 certificates need replacing.
Check every machine that builds or runs code (npx wardlatch --json fails a CI pipeline while anything is exposed), rebuild container images and compiled apps on fixed versions, replace any eMudhra-issued certificates, fence off devices that can’t be updated, review anything that accepts code signed through eMudhra, and check again after each fix. The six steps are in §07.
Card terminals usually talk only to their payment processor, often with certificates the processor controls, so many are not affected. Tills, kiosks and back-office PCs running Windows or Android use the system’s trust list and need system updates, and checkout code on your servers needs the fixes in §04. Ask your POS provider in writing whether their devices and software trust the eMudhra roots and when they update. PCI DSS already asks for an inventory of trusted certificates and that certificates protecting card data are valid and not revoked.
Only on a device or program that still trusts the leaked keys, and only to someone in its network path (public Wi-Fi, a compromised router): logins typed into a fake site, card details at a fake checkout, API keys and tokens that servers send, fake software updates, and messages between apps and their servers. No misuse has been reported. Businesses may want to rotate secrets sent by an exposed server over networks they don’t control, once it’s fixed.
As of 21 October 2026: PHP’s fixes for two critical flaws (due 21 Oct, 14:00 UTC); hijacked OVHcloud CLI versions 0.11.0 to 0.15.0 (19 Oct); credential-stealing GitHub Actions workflows planted since 7 Oct; AI agents breaking into company websites; an exploited Windows flaw fixed in October’s updates; data breaches with passwords in Denmark and Japan; backdoored WordPress plugins (Rank Math PRO 3.0.123 and stolen UpdraftCentral keys); a breach at PingCAP, the company behind TiDB Cloud; the Ahold Delhaize incident that took Food Lion’s sites offline; and the State Bank of India’s disclosure of exposed customer data, which makes bank-themed phishing likely. §08 says who is affected and what to do, and npx wardlatch checks the first three on your computer.
The advisory found no Certificate Transparency entries for these intermediates since they were created in April 2025, so browsers that require those logs could not have been attacked. Many other programs don’t require them, and the advisory says it can’t tell whether anyone used the flaw against them. That’s why updating everything matters.
Yes. It is free and open source (Apache-2.0), from Deimos AI LLC. The browser check only opens the advisory’s public test sites after you press the button, and keeps nothing. The command runs on your computer, sends nothing anywhere except connections to those test sites, and changes nothing: it shows each fix for you to apply.