Determinate Systems, Inc. | Status

Determinate Systems, Inc. | Status

Back
Oct 20, 2026 5:32 PM UTC Ongoing for 3d

eMudhra Intermediate CA Compromise

Updates

  • Oct 23, 2026 12:52 AM UTC

    Fri, 23 Oct 2026 00:51:10 UTC:

    The release of Determinate 3.24.0 is now complete and all artifacts are available.

    If you changed any automation to use version-pinned URLs, please revert to using the standard URLs for installation.

    CLI install:

        curl -fsSL https://install.determinate.systems/nix | sh -s -- install

    For security-related releases, we will typically leave the incident open for approximately twelve hours for visibility. In this case, we will keep it open until upstream NixOS has released updates for all channels.
    For questions, concerns, or more details, please contact us via support@determinate.systems.

    Monitoring
  • Oct 23, 2026 12:48 AM UTC (4 minutes earlier)

    Fri, 23 Oct 2026 00:46:47 UTC:

    DeterminateSystems/flakehub-cache-action@v3.24.0 is now available on GitHub Actions.

    For example:

    jobs:
    build:
    steps:
    ...
    - uses: DeterminateSystems/flakehub-cache-action@v3.24.0
    ...

    DeterminateSystems/determinate-nix-action@v3.24.0 is now available on GitHub Actions.

    For example:

    jobs:
    build:
    steps:
    ...
    - uses: DeterminateSystems/determinate-nix-action@v3.24.0
    ...

    NixOS AMIs with Determinate Nix version v3.24.0 are now available.

    We publish AMIs to the following AWS accounts:

    • AWS Commercial: 535002876703
    • AWS GovCloud: 579351485434
    • AWS European Sovereign Cloud: 129194717446

    For details about how to search for our AMIs, see: https://github.com/DeterminateSystems/nixos-amis#terraform

    DeterminateSystems/nix-eval-jobs v3.24.0 is now available.

    See: https://github.com/DeterminateSystems/nix-eval-jobs

    For questions, concerns, or more details, please contact us via support@determinate.systems.

    Monitoring
  • Oct 22, 2026 9:51 PM UTC (2 hours and 56 minutes earlier)

    Thu, 22 Oct 2026 21:49:29 UTC:

    The macOS package for Determinate Nix v3.24.0 is now available and is proceeding through our normal release cycle. That release cycle typically takes one hour. During that time, we will gradually increase the percentage of users who receive the new version.

    You can download the new package immediately: https://install.determinate.systems/determinate-pkg/tag/v3.24.0/Universal
    We recommend against hard-coding this URL in your automation.

    Further artifacts and releases are pending.
    For questions, concerns, or more details, please contact us via support@determinate.systems.

    Monitoring
  • Oct 22, 2026 9:41 PM UTC (10 minutes earlier)

    Thu, 22 Oct 2026 21:40:36 UTC:

    Determinate Nix Installer v3.24.0 is now available but is not yet the default. This new installer will proceed through our deployment process, which includes a staged rollout and monitoring. This process typically takes less than one hour. During that time, we will gradually increase the percentage of users who receive the new version.

    If you would like to expedite this process, you may specify the version when downloading the installer.

    Using the CLI:

        curl -fsSL https://install.determinate.systems/nix/tag/v3.24.0 | sh -s -- install

    We recommend against hard-coding this version-pinned URL in your automation.

    Note that an updated macOS package, DeterminateSystems/determinate-nix-action GitHub Action, and other artifacts are still pending.
    For questions, concerns, or more details, please contact us via support@determinate.systems.

    Monitoring
  • Oct 22, 2026 9:17 PM UTC (23 minutes earlier)

    Thu, 22 Oct 2026 21:17:26 UTC:

    NixOS ISOs with Determinate Nix version v3.24.0 are now available.

    You can download the new ISO for Aarch64 here: https://install.determinate.systems/nixos-iso/tag/v3.24.0/aarch64-linux

    You can download the new ISO for x86_64 (AMD / Intel) here: https://install.determinate.systems/nixos-iso/tag/v3.24.0/x86_64-linux

    For questions, concerns, or more details, please contact us via support@determinate.systems.

    Monitoring
  • Oct 22, 2026 9:05 PM UTC (12 minutes earlier)

    Thu, 22 Oct 2026 21:05:18 UTC:

    Determinate Nix v3.24.0 is now available via the determinate flake, https://flakehub.com/f/DeterminateSystems/determinate/3.24.0. Users managing their Determinate version via the flake, including NixOS users, can now update.

    Run nix flake update to update your flake inputs and then update your system as normal.

    Further artifacts, such as an updated installer and macOS package, are currently pending.
    For questions, concerns, or more details, please contact us via support@determinate.systems.

    Monitoring
  • Oct 22, 2026 8:55 PM UTC (9 minutes earlier)

    We are releasing an update to Determinate Nix which removes the compromised certificates from the CA bundle that is included in Determinate Nix. Additionally for macOS users, the Determinate Nix daemon will automatically exclude the compromised certificates even if they are present in the system keychain.

    Thu, 22 Oct 2026 20:40:06 UTC:

    Determinate Nix v3.24.0 is now available and is proceeding through our normal release cycle. That release cycle typically takes one hour. During that time, we will gradually increase the percentage of users who receive the new version.

    If you would like to upgrade existing installations on macOS or other imperatively managed systems immediately, you can run this command:

    sudo determinate-nixd upgrade --version v3.24.0

    Further artifacts, such as an updated installer and macOS package, are currently pending.
    For questions, concerns, or more details, please contact us via support@determinate.systems.

    Monitoring
  • Oct 21, 2026 1:26 PM UTC (1 day, 7 hours, and 29 minutes earlier)

    Determinate Secure Packages is now patched to distrust the eMudhra Intermediate CAs. Please immediately update your Nix flakes to use the latest release. Our patches include updating vendored Rust programs with outdated certificate lists.

    For Flake URLs, see: https://docs.determinate.systems/secure-packages/#distributions

    We will continue monitoring and will send additional updates if more outdated and vendored certificates are identified.

    Please contact support if you have further questions: https://docs.determinate.systems/contact/

    Monitoring
  • Oct 21, 2026 10:55 AM UTC (2 hours and 31 minutes earlier)

    Correction to the previous message: It said 25.05 was completely patched. It was intended to say 25.11 is completely patched. Corrected text below:

    secure-packages-26.05 and secure-packages-25.11 are now fully patched. This includes fips variants. secure-packages-rolling is continuing to build, and we will provide updates when it is complete.

    Investigating
  • Oct 21, 2026 10:34 AM UTC (20 minutes earlier)

    secure-packages-26.05 and secure-packages-25.11 are now fully patched. This includes fips variants. secure-packages-rolling is continuing to build, and we will provide updates when it is complete.

    Investigating
  • Oct 20, 2026 5:32 PM UTC (17 hours and 1 minute earlier)

    The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.

    We are urgently applying patches to Determinate Secure Packages Rolling, 26.05, and 25.11.

    See: https://emudhra.we-have-a-problem.com/

    Investigating