Overview
- Security researchers identified weak randomness in eight eMudhra intermediate CA keys on October 17 that allowed private keys to be feasibly recovered from public certificates.
- eMudhra revoked the affected intermediates on October 18 and Microsoft issued Windows updates on October 20 and October 26 to block or remove the compromised certificates.
- Besu published a Docker image update removing the bad roots in version 26.10.2 and Teku followed with version 26.10.3 to remove the same roots from their Docker images.
- A residual risk remains for operators running standalone Teku or Besu because Java does not check certificate revocation by default, so those users must update their local Java trust stores or install patched Java builds to be fully protected.
- Exploitation would require an attacker to intercept an HTTPS connection and present a forged certificate, Teku warned there have been no confirmed exploitations and Ethereum’s peer‑to‑peer protocols are not affected; the incident underscores growing operational risk from external services used by validators.