# Chainguard: Incident updated:  Removing trust in a compromised certificate authority (eMudhra emSign G3)

**Summary:** _summary pending_
- Kind: Incident update · Label: Normal progress (rule)
- Changed: 2026-10-21 18:33 UTC · Detected: 2026-10-21 18:33 UTC
- Source: n/a
- [Company: Chainguard](https://rewindex.com/company/chainguard.md)
- Versions: before incident\_version:727/1096060@2c0c87f6ebd0 → after incident\_version:727/1096060@3a43cf090dc1
- Change 4 of 6 for this incident

Incident page (full timeline): [Removing trust in a compromised certificate authority (eMudhra emSign G3)](https://rewindex.com/company/chainguard/incidents/1096060.md)
## What changed

**1. Added: Update** (degraded) · 2026-10-21 18:30 UTC

```diff
+ Updated Oct 21, 2026 at 1:05pm CDT Sync of updated images to customer registries continues. As of 17:51 UTC, 96.5% of the image tags customers actively sync carry the new certificate bundle (ca-certificates-bundle 20260909-r3), up from 95% at 16:06 UTC. We recommend you pull and redeploy now to pick up every updated image already in your registry. We have increased sync capacity, and based on current rates we expect the remaining images to reach customer registries within the next few hours, ahead of our earlier estimate of October 23, 02:00 UTC. We'll notify you when the sync is complete, so you can pull and redeploy again. A small number of repositories, including pytorch, pytorch-fips and os-shell-iamguarded, have not yet synced. If you pull one of these and still see an older bundle version, check again shortly. Fixes for applications that bundle their own certificates continue to land: the uv fix for Python is merged, gRPC fixes are merged for several images and in progress for the rest, and Node.js is covered in the remediation guide. For steps to update, confirm the fix, and handle applications that bundle their own certificates, see the remediation guide: https://support.chainguard.dev/hc/en-us/articles/57499369353755-ACTION-RECOMMENDED-Update-all-Chainguard-Images-to-remove-eMudhra-Intermediate-CA-Data. Next update by October 22, 02:00 UTC.
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-10-20 22:03 UTC | [Incident updated:  Removing trust in a compromised certificate authority (eMudhra emSign G3)](https://rewindex.com/change/r57b0d2993933f0.md) | Normal progress |
| 2026-10-21 00:03 UTC | [Incident updated:  Removing trust in a compromised certificate authority (eMudhra emSign G3)](https://rewindex.com/change/r4fa526b64373bd.md) | Normal progress |
| 2026-10-21 14:53 UTC | [Incident updated:  Removing trust in a compromised certificate authority (eMudhra emSign G3)](https://rewindex.com/change/rfc9f64060d362c.md) | Normal progress |
| 2026-10-21 18:33 UTC | Incident updated:  Removing trust in a compromised certificate authority (eMudhra emSign G3) (this change) | Normal progress |
| 2026-10-22 22:23 UTC | [Incident updated:  Removing trust in a compromised certificate authority (eMudhra emSign G3)](https://rewindex.com/change/rf5c5cfa77bdc14.md) | Normal progress |
| 2026-10-23 11:33 UTC | [Incident silently edited:  Removing trust in a compromised certificate authority (eMudhra emSign G3)](https://rewindex.com/change/r49ab64bf9a8149.md) | Normal progress |

Previous: [change](https://rewindex.com/change/rfc9f64060d362c.md) · Next: [change](https://rewindex.com/change/rf5c5cfa77bdc14.md) · All Chainguard changes: [timeline](https://rewindex.com/company/chainguard/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/re0347097673c96 · Markdown: https://rewindex.com/change/re0347097673c96.md · JSON: https://rewindex.com/api/v1/changes/re0347097673c96 · Generated 2026-10-24T11:02:33.410Z