October 2026 Summaries

A compromise of eight eMudhra intermediate certificate private keys could allow attackers to create fraudulent TLS certificates for arbitrary domains or code-signing certificates that appear trusted, creating risks of impersonation and man-in-the-middle attacks across software that relies on public certificate authorities. The affected P-384 intermediates were revoked on October 18, but the broader G3 ECC root is also being distrusted, requiring roughly 30,000 legitimate certificates to be reissued. Twingate reports no direct impact or evidence of exploitation involving its services or customers, though it is updating shared trust stores, base images, endpoint-authentication services, and bundled certificate stores that may still trust the compromised intermediates. Customers do not need to act specifically for Twingate, but are encouraged to patch operating systems, runtimes, containers, libraries, and custom trust stores; investigate logs for potentially malicious certificates; validate all certificate-verification paths; avoid disabling certificate checks; and review mutual TLS and internally managed CA configurations. The incident underscores the value of layered, identity-based access controls, which can limit the consequences of a compromised certificate authority.