Cyber ·
Bundled certificate stores and compromised eMudhra certificates
The oss-sec feed notice dated October 20, 2026 warns that compromised eMudhra certificates may affect software that ships its own root certificate store, such as a CA bundle included in Linux distributions.
The notice, posted to the oss-sec feed on October 20, 2026, concerns the recent compromise of eMudhra certificates. According to the report, any software that includes its own root certificate store may be affected, because that local copy does not automatically follow removals made at the system level. The author checked their own systems by searching for .crt files installed under /usr. They found curl-ca-bundle.crt inside a TeX Live installer. That file belongs to the texlive-core package on Gentoo, which uses a file from an upstream package called texlive-infra. According to the text, that package contains the affected certificates, including entries from the Comodo AAA Services family. The text available here is an automatic translation and is truncated, so the full scope does not appear in this copy. To consult the original, use the public oss-sec archive for 2026 and check your distribution's guidance. To verify your own environment, list the installed certificate files, identify the package that owns each one, and confirm whether the version includes the fix your distribution specifies.