FOR IMMEDIATE RELEASE

TORONTO, November 1, 2026 — Browsers acted first. Revocation followed a day later. The compromised certificates kept being trusted anyway, inside the Docker images that run two of the most widely used Ethereum clients. This week, the client teams closed that gap themselves.

Teku, the consensus client used by many Ethereum validators, released version 26.10.3 on October 27. Besu, the execution client that processes Ethereum transactions, released version 26.10.2 on October 26. Both updates remove trust for certificates linked to eMudhra from their Docker images, the prepackaged builds many operators deploy.

The underlying problem dates to October 17, when researchers found that the private keys behind eight of eMudhra's intermediate certificate authorities had been generated with too little randomness, so the keys could be derived from the publicly available certificates. Anyone holding those keys could issue certificates that unpatched software would accept. Browsers blocked the certificates, eMudhra revoked them on October 18, and the company has since said it will exit the certificate business.

Java, the runtime underneath both clients, does not check whether a certificate has been revoked by default. That meant Teku's Docker images kept trusting the compromised certificates well after browsers had dropped them. The new releases remove four roots from the Docker images: emSign ECC Root CA - G3, emSign Root CA - G1, emSign Root CA - G2, and AAA Certificate Services.

The risk was narrow, and its limits matter. Teku's security advisory states that a default Teku node on mainnet is not affected and needs no action, and that no exploitation has been reported. Peer-to-peer networking does not use certificate authorities and was not affected. The exposure applied to HTTPS connections to outside services, such as a remote beacon node, an external signer, builders, or relays. In the riskiest setup, a fake external signer, which holds validator keys and returns signatures, could have been used to change where rewards go. An attacker would still have needed a network position from which to intercept the traffic.

The remediation split is the part most likely to be missed. Docker users should pull the newest Teku or Besu images. Operators running either client directly on a host must update Java separately, because upgrading the client does not replace the host runtime's trusted-certificate list, and the refreshed Docker images do not repair Java installed on the host either. Operators still on Java 26 face a harder path: that version has reached end of life and will not receive a patched build, so they need to move to Java 25.

"Revocation is not the same as removal," said Sarah Reid, Securetron spokesperson. "A certificate can be revoked and blocked in browsers and still be trusted in a container image, a Java runtime, or a device trust store nobody inventoried. You cannot fix what you have not found, in every place it is trusted."

That is the case for certificate discovery across the whole estate, not just the browser fleet. PKI Trust Manager continuously discovers certificates, expiring assets, and vulnerabilities across the enterprise, with automated issuance, renewal, and monitoring for the entire certificate lifecycle. A built-in ACME server with SCEP and EST support lets certbot, acme.sh, win-acme, and network devices enrol automatically, and a single pane of glass covers ADCS, MSCA, Let's Encrypt, DigiCert, and ACME, with full audit trails for every action. Boltron-AI discovers certificates, applications, and PKI assets, profiles their configurations, and generates onboarding runbooks for PKI Trust Manager.

The Community Edition of PKI Trust Manager manages up to 500 certificates free, on-premises or as a service. For more information, visit https://securetron.net.

About Securetron
Securetron builds enterprise security infrastructure: PKI Trust Manager and PKI Trust Cloud for certificate lifecycle automation, with Boltron-AI for AI-driven PKI onboarding, and AI-FW, the self-hosted AI firewall and governance gateway between AI agents and LLM backends. For more information, visit https://securetron.net and https://aifw.io.

Press contact:
Sarah Reid
Securetron
1 Yonge St, Toronto, ON M5E 1E6, Canada
+1 (438) 927-8036
[email protected]

###