Determinate Systems, Inc. | Status
eMudhra Intermediate CA Compromise
Updates
-
Oct 21, 2026 1:26 PM UTC
Determinate Secure Packages is now patched to distrust the eMudhra Intermediate CAs. Please immediately update your Nix flakes to use the latest release. Our patches include updating vendored Rust programs with outdated certificate lists.
For Flake URLs, see: https://docs.determinate.systems/secure-packages/#distributions
We will continue monitoring and will send additional updates if more outdated and vendored certificates are identified.
Please contact support if you have further questions: https://docs.determinate.systems/contact/
Monitoring -
Oct 21, 2026 10:55 AM UTC (2 hours and 31 minutes earlier)
Correction to the previous message: It said 25.05 was completely patched. It was intended to say 25.11 is completely patched. Corrected text below:
secure-packages-26.05 and secure-packages-25.11 are now fully patched. This includes fips variants. secure-packages-rolling is continuing to build, and we will provide updates when it is complete.
Investigating -
Oct 21, 2026 10:34 AM UTC (20 minutes earlier)
secure-packages-26.05 and secure-packages-25.11 are now fully patched. This includes fips variants. secure-packages-rolling is continuing to build, and we will provide updates when it is complete.
Investigating -
Oct 20, 2026 5:32 PM UTC (17 hours and 1 minute earlier)
The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.
We are urgently applying patches to Determinate Secure Packages Rolling, 26.05, and 25.11.
Investigating