[Security Advisory] eMudhra intermediate certificates compromise

Eight eMudhra intermediate CA private keys were compromised through a key-generation flaw that allows recovery from public certificates, potentially enabling fraudulent certificates and impersonation against systems that still trust the affected chains. Nebius has removed the compromised trust chains from current Compute VM images and updated new Managed Kubernetes node groups, while advising customers to recreate VMs and upgrade or otherwise mitigate existing Kubernetes nodes through cloud-init or a temporary DaemonSet. Soperator trust bundles have been updated, with broader image upgrades requiring scheduled downtime; newly created Managed PostgreSQL, SkyPilot, and MLflow clusters include fixes, while existing clusters are scheduled for maintenance updates on October 29 and November 3, 2026. Updated Serverless images require existing Endpoints and Devlabs to be restarted, Token Factory has fixed public-facing components with internal updates pending, and Tavily’s hosted APIs are unaffected, although internal component updates continue. Nebius reports no evidence of unauthorized access or customer-data exposure but urges customers to apply relevant mitigations promptly.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.