{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/certifi--2026.10.18/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["certifi (\u003c 2026.10.18)"],"_cs_severities":["critical"],"_cs_tags":["certificate-authority","tls-interception","python"],"_cs_type":"advisory","_cs_vendors":["eMudhra"],"content_html":"\u003cp\u003eThe certifi maintainer removed emSign root certificates from the bundled CA store in version 2026.10.18 after intermediates chaining to those roots were revoked for key compromise. Mozilla separately reported the compromise of eight eMudhra intermediate certificates. A compromised CA key can enable fraudulent certificates and a man-in-the-middle attack when an attacker is on path. The cited advisories do not report an observed attack against certifi users.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eApplications that use an affected certifi CA bundle for TLS validation may trust certificates issued through the compromised intermediates. The risk depends on whether the application uses that bundle and whether an attacker can intercept its connection.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify applications and images that use certifi versions before 2026.10.18.\u003c/li\u003e\n\u003cli\u003eUpgrade affected installations to certifi 2026.10.18 or later and rebuild images that bundle an older release.\u003c/li\u003e\n\u003cli\u003eCheck which TLS clients use certifi rather than an operating-system trust store so remediation targets the affected paths.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T23:53:18Z","date_published":"2026-10-20T23:53:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-certifi-compromised-roots/","summary":"Certifi versions before 2026.10.18 included emSign roots whose intermediate keys were compromised. An attacker able to position on path could use a fraudulent certificate to intercept TLS traffic.","title":"Certifi: Bundled eMudhra root CAs with compromised intermediate keys","url":"https://feed.craftedsignal.io/briefs/2026-10-certifi-compromised-roots/"}],"language":"en","title":"CraftedSignal Threat Feed - Certifi (\u003c 2026.10.18)","version":"https://jsonfeed.org/version/1.1"}