# Chainguard: Incident silently edited:  Removing trust in a compromised certificate authority (eMudhra emSign G3)

**Summary:** _summary pending_
- Kind: Silent edit · Label: not classified yet
- Changed: 2026-10-23 11:33 UTC · Detected: 2026-10-23 11:33 UTC
- Source: n/a
- [Company: Chainguard](https://rewindex.com/company/chainguard.md)
- Versions: before incident\_version:727/1096060@219949ef59dd → after incident\_version:727/1096060@83f64161f322
- Change 6 of 6 for this incident

Incident page (full timeline): [Removing trust in a compromised certificate authority (eMudhra emSign G3)](https://rewindex.com/company/chainguard/incidents/1096060.md)
## What changed

**1. Changed: Status**

```diff
- ongoing
+ resolved
```

**2. Added: Resolved time**

```diff
+ 2026-10-22 22:14 UTC
```

**3. Changed: Update** (degraded → resolved) · 2026-10-22 22:14 UTC

```diff
- Updated Oct 22, 2026 at 5:14 pm CDT The sync of updated images to customer registries is complete. Every Chainguard image and Helm chart now carries the new certificate bundle (ca-certificates-bundle 20260909-r3), except the spegel Helm chart, which is still being updated. If you have not pulled and redeployed since October 21, do so now to pick up every updated image in your registry. Fixes for applications that ship their own list of trusted certificates continue to land. Java: all cacerts fixes are merged and 35 of 37 catalog Java images are rebuilt; the Corretto 21 JRE and Tomcat on Corretto images are still rebuilding. Node.js: 70 of 72 catalog images are on the updated build; Node 22 and 26 are complete, two Node 24 images are still rebuilding, and Node 20 and 25 are waiting on new upstream releases. Python: images that bundle certifi, including the OpenStack images, are being updated to certifi 2026.10.19. Fixes for the Ruby AWS SDK and nmap are in progress. To confirm an image is fixed, check its SBOM for ca-certificates-bundle 20260909-r3 and use the newest build for the applications above. If you pin by digest, move to the new digest. Full steps are in the remediation guide: https://support.chainguard.dev/hc/en-us/articles/57499369353755-ACTION-RECOMMENDED-Update-all-Chainguard-Images-to-remove-eMudhra-Intermediate-CA-Data. Next update by October 23, 16:00 UTC.
+ Updated Oct 22, 2026 at 5:14 pm CDT The sync of updated images to customer registries is complete. Every Chainguard image and Helm chart now carries the new certificate bundle (ca-certificates-bundle 20260909-r3), except the spegel Helm chart, which is still being updated. If you have not pulled and redeployed since October 21, do so now to pick up every updated image in your registry. Fixes for applications that ship their own list of trusted certificates continue to land. Java: all cacerts fixes are merged and 35 of 37 catalog Java images are rebuilt; the Corretto 21 JRE and Tomcat on Corretto images are still rebuilding. Node.js: 70 of 72 catalog images are on the updated build; Node 22 and 26 are complete, two Node 24 images are still rebuilding, and Node 20 and 25 are waiting on new upstream releases. Python: images that bundle certifi, including the OpenStack images, are being updated to certifi 2026.10.19. Fixes for the Ruby AWS SDK and nmap are in progress. To confirm an image is fixed, check its SBOM for ca-certificates-bundle 20260909-r3 and use the newest build for the applications above. If you pin by digest, move to the new digest. Full steps are in the remediation guide: https://support.chainguard.dev/hc/en-us/articles/57499369353755-ACTION-RECOMMENDED-Update-all-Chainguard-Images-to-remove-eMudhra-Intermediate-CA-Data. Next update by October 23, 16:00 UTC.
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-10-20 22:03 UTC | [Incident updated:  Removing trust in a compromised certificate authority (eMudhra emSign G3)](https://rewindex.com/change/r57b0d2993933f0.md) | Normal progress |
| 2026-10-21 00:03 UTC | [Incident updated:  Removing trust in a compromised certificate authority (eMudhra emSign G3)](https://rewindex.com/change/r4fa526b64373bd.md) | Normal progress |
| 2026-10-21 14:53 UTC | [Incident updated:  Removing trust in a compromised certificate authority (eMudhra emSign G3)](https://rewindex.com/change/rfc9f64060d362c.md) | Normal progress |
| 2026-10-21 18:33 UTC | [Incident updated:  Removing trust in a compromised certificate authority (eMudhra emSign G3)](https://rewindex.com/change/re0347097673c96.md) | Normal progress |
| 2026-10-22 22:23 UTC | [Incident updated:  Removing trust in a compromised certificate authority (eMudhra emSign G3)](https://rewindex.com/change/rf5c5cfa77bdc14.md) | Normal progress |
| 2026-10-23 11:33 UTC | Incident silently edited:  Removing trust in a compromised certificate authority (eMudhra emSign G3) (this change) |  |

Previous: [change](https://rewindex.com/change/rf5c5cfa77bdc14.md) · All Chainguard changes: [timeline](https://rewindex.com/company/chainguard/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/r49ab64bf9a8149 · Markdown: https://rewindex.com/change/r49ab64bf9a8149.md · JSON: https://rewindex.com/api/v1/changes/r49ab64bf9a8149 · Generated 2026-10-24T10:17:40.179Z