Changes Buildkite Buildkite response to the eMudhra certificate compromise

Buildkite: Incident updated: Buildkite response to the eMudhra certificate compromise

Incident updateNormal progress (rule, 100%)Changed 2026-10-20 23:33 UTCstspg.io

Summary

Summary pending. The diff below shows exactly what changed.

Incident page: the full timeline of updates

What changed

~~Struck in red~~ is what Buildkite removed; blue is what they added. Muted text is unchanged context.

ChangedStatus#1

~~investigating~~

monitoring

AddedUpdatemonitoring2026-10-20 23:25 UTC#2

not present

We're continuing to monitor the situation, and are making releases to many of our components that run in customer infrastructure. At time of writing, we've released versions that distrust the affected eMudhra certificates for: - Buildkite agent: https://github.com/buildkite/agent: - v4.7.0: https://github.com/buildkite/agent/releases/tag/v4.7.0 - v3.138.2: https://github.com/buildkite/agent/releases/tag/v3.138.2 - Buildkite CLI: https://github.com/buildkite/cli/releases/tag/v3.64.2 - bktec: https://github.com/buildkite/test-engine-client/releases/tag/v3.3.1 We recommend updating to these versions to prevent exposure to the affected certificate providers. We will continue to issue updates for the other binaries we distribute, and are updating any internal services that are affected.

Compared with the previous archived version of this incident (10 to 30-minute polling). View the live incident (opens in new tab).

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Oct 20
Before captured 22:33 UTC
In the 2026-10-20 checkpoint, timestamped by FreeTSA and DigiCert on Oct 21, 00:41 UTC. Record hash 1a3610e728f5ffe3…
Download proof
Oct 20
After captured 23:33 UTC
In the 2026-10-20 checkpoint, timestamped by FreeTSA and DigiCert on Oct 21, 00:41 UTC. Record hash 09ef043e60356c1e…
Download proof

History of this incident

Wednesday, October 21

2 incident changes

Normal progress
22:43Incident
Incident updateBuildkite response to the eMudhra certificate compromise
Normal progress
05:13Incident
Incident updateBuildkite response to the eMudhra certificate compromise

Tuesday, October 20

1 incident change

Normal progress
23:33Incident
Incident updateBuildkite response to the eMudhra certificate compromisethis change

Cite this

Incident updated: Buildkite response to the eMudhra certificate compromise on Buildkite’s status page, changed 2026-10-20 23:33 UTC (change 1 of 3).

Title: Incident updated: Buildkite response to the eMudhra certificate compromise
Vendor: Buildkite
Date: 2026-10-20 23:33 UTC
URL: https://rewindex.com/change/r4bced361de0b8a

All Buildkite changes Buildkite profile Markdown JSON