On 2026-10-20, it has been disclosed that the private keys of eight eMudhra intermediate CA certificates have been compromised. These keys can be used to issue forged CA certificates that would be considered fully trusted by the affected software, and therefore could be used to perform man-in-the-middle attacks.

Importantly, the vulnerability can also affect software self-update processes that use TLS verification as the only security measure, with an attempt to upgrade the system leading to it being compromised. The standard Gentoo configuration mitigates this risk, as both the ebuild repository updates and binary package downloads are secured using OpenPGP keys. A malicious third party may be able to intercept update requests, but Portage will reject any tampered packages or metadata.

The baseline remediation is to upgrade to >=app-misc/ca-certificates-20260816.3.125. However, some packages are using bundled certificate stores and require separate remediation. In some cases the bundled certificates are updated automatically, in others, the relevant packages will need to be upgraded. We are actively tracking the affected packages in bug 984601, and releasing fixed versions to Gentoo stable ASAP. We are also looking into forcing the use of the system certificate store in more packages, per our unbundling policy.

Please note that packages installed outside Gentoo package manager are also affected. For example, Python virtual environments featuring the prior versions of certifi, pip or uv packages are vulnerable. Please refer to the Python upstream announcement for more details and the recommended remediation.

EDIT 2026/10/18: To speed up the process, please include critical details in your initial email to infra@gentoo.org. The Gentoo Infra team have received offers with poor connectivity or lacking public IPs, and we strive to be good neighbor in any sponsored environment.

Gentoo Linux is made possible by many community donations and sponsors, together with the enthusiastic work of our developers. Unfortunately, this year several long-running sponsors were unable to continue their prior support, and at the moment we are looking for replacements.

Are you or your organization interested in supporting Gentoo via an infrastructure sponsorship? There are many ways to do that, ranging from providing rack space or servers in a data center to donating server hardware; details and typical arrangements are described on a wiki page of the Infrastructure project. Partnerships with organizations aligning with Gentoo’s goals are strongly preferred. We can be reached at infra@gentoo.org. Please help us continue to provide the best source-based Linux distribution ever!